CVE-2026-53440: Medium severity Jenkins Jenkins vulnerability
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the "Delegate to servlet container" security realm until a fixed Jenkins release is applied to prevent unsafe redirection via the "from" parameter after login.
Jenkins - "Delegate to servlet container" security realm Delegate to servlet container enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53440?
CVE-2026-53440 has a severity rating of medium, with a CVSS score of 4.3.
How do I fix CVE-2026-53440?
To fix CVE-2026-53440, update Jenkins to version 2.568 or later, or to LTS 2.556 or later.
What impact does CVE-2026-53440 have on Jenkins users?
CVE-2026-53440 may allow attackers to perform phishing attacks by redirecting users to malicious websites after login.
Is CVE-2026-53440 present in all versions of Jenkins?
CVE-2026-53440 affects Jenkins versions 2.567 and earlier, as well as LTS versions 2.555.2 and earlier.
What is the main vulnerability in CVE-2026-53440?
The main vulnerability in CVE-2026-53440 is the unsafe handling of the 'from' parameter in the security realm, leading to potential phishing.