CVE-2026-53437: High severity Jenkins Jenkins vulnerability
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable automatic post-login redirects where feasible. If redirects are required, enforce strict validation/normalization of redirect URLs and reject any redirect parameter containing tab (\t) or newline (\n) characters between '//' (including percent-encoded equivalents).
Jenkins post-login redirect handling = disabled or validate redirects to reject URLs with tab/newline between '//' - Compensating control
Apply a WAF/reverse-proxy rule to block or normalize redirect parameters that contain tab or newline characters (or their percent-encoded forms) between '//' to prevent open redirect/phishing abuse. Additionally, restrict access to the Jenkins UI (management/login endpoints) to trusted IP ranges until an upstream fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53437?
The severity of CVE-2026-53437 is medium, rated at 4.3 according to CVSS 3.1.
How do I fix CVE-2026-53437?
To fix CVE-2026-53437, upgrade Jenkins to version 2.568 or later, and LTS to 2.555.3 or later.
What type of attack does CVE-2026-53437 enable?
CVE-2026-53437 enables phishing attacks by improperly allowing redirect URLs to be exploited.
Which versions of Jenkins are affected by CVE-2026-53437?
Jenkins versions 2.567 and earlier, and LTS versions 2.555.2 and earlier are affected by CVE-2026-53437.
What is the impact of CVE-2026-53437?
The impact of CVE-2026-53437 is that it can lead to successful phishing attacks that compromise user credentials.