Executive brief
Jenkins, a widely-used automation server, improperly validates redirect URLs after user login by failing to recognize that relative path segments like `./` and `../` can be manipulated to redirect users to attacker-controlled websites. An attacker can craft a malicious login link that appears to redirect to Jenkins but actually sends users to a phishing site to steal credentials. This affects Jenkins users through approximately version 2.567 and earlier.
Technical details
This is an open redirect vulnerability (CWE-601) in Jenkins' post-login redirect URL validation. The root cause is that Jenkins validates the redirect URL to check if it points legitimately to Jenkins before the servlet container collapses relative path segments (`./` or `../`) into a scheme-relative URL (starting with `//`). An attacker can craft a URL like `./../../attacker.com` which passes validation but is later interpreted by the browser as a redirect to `attacker.com`. The vulnerability requires user interaction (the user must click a crafted login link) but requires no authentication or special privileges to exploit. A successful attack allows redirection to an arbitrary attacker-controlled domain for phishing purposes. Patches are available in Jenkins 2.568 and LTS 2.555.3, which strip and validate URLs before redirect operations.
Affected products
- Jenkins Jenkins 2.567 and earlier; LTS 2.555.2 and earlier
Timeline
- 2026-06-10: disclosed
- 2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3