# CVE-2026-53436: Jenkins open redirect via relative path segments in login flow

Source: https://junglewise.ai/threats/cve-2026-53436-jenkins-open-redirect-via-relative-path-segments-in-login-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-53436 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Jenkins, a widely-used automation server, improperly validates redirect URLs after user login by failing to recognize that relative path segments like `./` and `../` can be manipulated to redirect users to attacker-controlled websites. An attacker can craft a malicious login link that appears to redirect to Jenkins but actually sends users to a phishing site to steal credentials. This affects Jenkins users through approximately version 2.567 and earlier.

Technologies: [Jenkins](https://junglewise.ai/threats/technologies/jenkins), [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-53436 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53436 being exploited in the wild.

**How severe is CVE-2026-53436?** Medium severity, with a CVSS score of 4.3, published 10 June 2026.

**Which products and versions are affected?** Jenkins 2.567 and earlier; LTS 2.555.2 and earlier; org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=2.556,fixed=2.568.

**Is there a fix for CVE-2026-53436?** Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.568 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53436 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-53436?** Check whether you run Jenkins or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.568 or later

  ```sh
  # set org.jenkins-ci.main:jenkins-core to 2.568 in your pom.xml or build.gradle
  ```


## Technical details

This is an open redirect vulnerability (CWE-601) in Jenkins' post-login redirect URL validation. The root cause is that Jenkins validates the redirect URL to check if it points legitimately to Jenkins before the servlet container collapses relative path segments (`./` or `../`) into a scheme-relative URL (starting with `//`). An attacker can craft a URL like `./../../attacker.com` which passes validation but is later interpreted by the browser as a redirect to `attacker.com`. The vulnerability requires user interaction (the user must click a crafted login link) but requires no authentication or special privileges to exploit. A successful attack allows redirection to an arbitrary attacker-controlled domain for phishing purposes. Patches are available in Jenkins 2.568 and LTS 2.555.3, which strip and validate URLs before redirect operations.

## Affected products

- Jenkins Jenkins 2.567 and earlier; LTS 2.555.2 and earlier

## Identifiers

- CVE-2026-53436
- GHSA-3rqh-hch3-jhpc

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3

## References

- [https://www.jenkins.io/security/advisory/2026-06-10/](https://www.jenkins.io/security/advisory/2026-06-10/)
- [https://github.com/jenkinsci/jenkins/commit/8ef52891b07eb639b38271e4bab5dab3c0f10fda](https://github.com/jenkinsci/jenkins/commit/8ef52891b07eb639b38271e4bab5dab3c0f10fda)
- [https://github.com/jenkinsci/jenkins/commit/b32f2f27a82ed187a34f55b05edcc4a83563d574](https://github.com/jenkinsci/jenkins/commit/b32f2f27a82ed187a34f55b05edcc4a83563d574)

## Related threats

- [Jenkins path traversal in file browser workspace disclosure](https://junglewise.ai/threats/cve-2026-117626-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-improperly)
- [Jenkins missing HTTP proxy permission check](https://junglewise.ai/threats/cve-2026-117625-a-missing-permission-check-in-jenkins-2-587-and-earlier-lts-2)
- [Jenkins deserialization filter bypass in XStream resolves-to attribute](https://junglewise.ai/threats/cve-2026-117624-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins stored cross-site scripting in breadcrumb menu tooltips](https://junglewise.ai/threats/cve-2026-117623-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-does-not)
- [Jenkins agent XSS via Stapler HttpResponse exceptions](https://junglewise.ai/threats/cve-2026-117622-jenkins-2-587-and-earlier-lts-2-580-1-and-earlier-allows-agents)