CVE-2026-53440: Jenkins open redirect in Delegate to servlet container security realm

CVE-2026-53440 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Jenkins is an automation server widely used for continuous integration and deployment across organizations. When configured with the "Delegate to servlet container" security realm, the login flow uses an unvalidated "from" parameter to redirect users after successful authentication. An attacker can craft a malicious link that redirects users to a fake login page or credential-harvesting site, enabling phishing attacks against Jenkins users and potentially compromising their accounts and sensitive data.

Technologies: Jenkins, Jenkins LTS, org.jenkins-ci.main:jenkins-core (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2026-53440 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53440 being exploited in the wild.
How severe is CVE-2026-53440?
Medium severity, with a CVSS score of 4.3, published 10 June 2026.
Which products and versions are affected?
Jenkins 2.567 and earlier; Jenkins LTS 2.555.2 and earlier; org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=0,fixed=2.555.3.
Is there a fix for CVE-2026-53440?
Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53440 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-53440?
Check whether you run Jenkins, Jenkins LTS or org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later
    # set org.jenkins-ci.main:jenkins-core to 2.555.3 in your pom.xml or build.gradle

Technical details

This is an open redirect vulnerability (CWE-601) in the "Delegate to servlet container" security realm component of Jenkins. The vulnerability exists because the "from" parameter, which specifies where to redirect users after login, is not properly validated to ensure it points to a safe location. An attacker can craft a link with a "from" parameter pointing to an attacker-controlled domain; when a user clicks the link and logs in, they are redirected to the attacker's domain, facilitating phishing attacks. The attack requires user interaction (the user must click the malicious link and log in). No special privileges are required from the attacker. Jenkins 2.568 and LTS 2.555.3 fix this by validating the "from" parameter to ensure it is safe to redirect to after login.

Affected products

  • Jenkins Jenkins 2.567 and earlier
  • Jenkins Jenkins LTS 2.555.2 and earlier

Identifiers

  • CVE-2026-53440
  • GHSA-92m7-4fpw-2wxm

Timeline

  • 2026-06-10: disclosed: Vulnerability disclosed via Jenkins Security Advisory 2026-06-10
  • 2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.