CVE-2026-53437

MEDIUM 4.3

CVSS Score

4.3

EPSS Score

0.4%

EPSS Percentile

29th

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

Vendor	jenkins project
Product	jenkins
Ecosystems	DevTools CI/CD
Industries	Technology
Published	Jun 10, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for jenkins project jenkins

Be the first to know when new medium vulnerabilities affecting jenkins project jenkins are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Jenkins Project / Jenkins

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

jenkins.io: https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-53437 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2487544 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json