Medium severity4.3NVD Advisory· Published Jun 10, 2026· Updated Jun 11, 2026
CVE-2026-53436
CVE-2026-53436
Description
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (./ or ../), allowing attackers to perform phishing attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4<=2.567, L=2.555.2+ 1 more
- (no CPE)range: <=2.567, L=2.555.2
- (no CPE)range: <=2.567, LTS <=2.555.2
- osv-coords2 versions
< 2.555.3-r0+ 1 more
- (no CPE)range: < 2.555.3-r0
- (no CPE)range: < 2.555.3
Patches
Vulnerability mechanics
References
1- www.jenkins.io/security/advisory/2026-06-10/nvdVendor Advisory
News mentions
2- Jenkins Core: Eight Vulnerabilities Disclosed Together on June 10, 2026Vypr Intelligence · Jun 10, 2026
- Jenkins Security Advisory 2026-06-10Jenkins Security Advisories · Jun 10, 2026