CVE-2026-53436: Jenkins open redirect via relative path segments in login flow

CVE-2026-53436 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Jenkins, a widely-used automation server, improperly validates redirect URLs after user login by failing to recognize that relative path segments like `./` and `../` can be manipulated to redirect users to attacker-controlled websites. An attacker can craft a malicious login link that appears to redirect to Jenkins but actually sends users to a phishing site to steal credentials. This affects Jenkins users through approximately version 2.567 and earlier.

Technologies: Jenkins, org.jenkins-ci.main:jenkins-core (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2026-53436 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53436 being exploited in the wild.
How severe is CVE-2026-53436?
Medium severity, with a CVSS score of 4.3, published 10 June 2026.
Which products and versions are affected?
Jenkins 2.567 and earlier; LTS 2.555.2 and earlier; org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=2.556,fixed=2.568.
Is there a fix for CVE-2026-53436?
Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.568 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53436 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-53436?
Check whether you run Jenkins or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.568 or later
    # set org.jenkins-ci.main:jenkins-core to 2.568 in your pom.xml or build.gradle

Technical details

This is an open redirect vulnerability (CWE-601) in Jenkins' post-login redirect URL validation. The root cause is that Jenkins validates the redirect URL to check if it points legitimately to Jenkins before the servlet container collapses relative path segments (`./` or `../`) into a scheme-relative URL (starting with `//`). An attacker can craft a URL like `./../../attacker.com` which passes validation but is later interpreted by the browser as a redirect to `attacker.com`. The vulnerability requires user interaction (the user must click a crafted login link) but requires no authentication or special privileges to exploit. A successful attack allows redirection to an arbitrary attacker-controlled domain for phishing purposes. Patches are available in Jenkins 2.568 and LTS 2.555.3, which strip and validate URLs before redirect operations.

Affected products

  • Jenkins Jenkins 2.567 and earlier; LTS 2.555.2 and earlier

Identifiers

  • CVE-2026-53436
  • GHSA-3rqh-hch3-jhpc

Timeline

  • 2026-06-10: disclosed
  • 2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.