CVE-2026-53440

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-25)

CWE

CWE-601

Published

2026-06-10

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• jenkins:jenkins

Packages (OSV)

References

• https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3721

Check your stackJSON