CVE-2026-53437: Jenkins open redirect via tab or newline characters in login URL

CVE-2026-53437 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Jenkins is an automation server widely used for continuous integration and deployment. This vulnerability allows attackers to bypass URL validation during login and redirect users to malicious websites, enabling phishing attacks to steal credentials. An attacker can craft a specially formatted redirect URL with hidden tab or newline characters that bypasses security checks, tricking users into visiting attacker-controlled domains.

Technologies: Jenkins, org.jenkins-ci.main:jenkins-core (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2026-53437 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53437 being exploited in the wild.
How severe is CVE-2026-53437?
Medium severity, with a CVSS score of 4.3, published 10 June 2026.
Which products and versions are affected?
Jenkins < 2.555.3 and >= 2.556, < 2.568; org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=0,fixed=2.555.3.
Is there a fix for CVE-2026-53437?
Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53437 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-53437?
Check whether you run Jenkins or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later
    # set org.jenkins-ci.main:jenkins-core to 2.555.3 in your pom.xml or build.gradle

Technical details

This is a URL redirection to untrusted site (open redirect) vulnerability (CWE-601) in Jenkins' login redirect validation logic. The vulnerable component is the post-login redirect handler, which checks whether a redirect URL is safe by validating that it does not contain a scheme (http://, https://, etc.) or start with //. However, the validation fails to strip tab (\t) and newline (\n) characters before performing this check. An attacker can insert a tab or newline character between // (e.g., "/\t/attacker.com"), which passes the validation check but is normalized by the browser to a scheme-relative URL pointing to attacker.com. The attack requires user interaction (clicking a login link with a crafted redirect parameter) but no prior authentication. Jenkins 2.568 and LTS 2.555.3 fix this by stripping tab and newline characters before validation and rejecting URLs containing // anywhere in the string.

Affected products

  • Jenkins Jenkins < 2.555.3 and >= 2.556, < 2.568

Identifiers

  • CVE-2026-53437
  • GHSA-463r-5m89-4xfr

Timeline

  • 2026-06-10: disclosed
  • 2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.