VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jun 10, 2026· Updated Aug 27, 2026

CVE-2026-53437

CVE-2026-53437

Description

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.main:jenkins-coreMaven
< 2.555.32.555.3
org.jenkins-ci.main:jenkins-coreMaven
>= 2.556, < 2.5682.568

Affected products

5
  • Jenkins Project/Jenkins3 versions
    cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*+ 2 more
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*range: <2.555.3
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*range: <2.568
    • (no CPE)range: <=2.567, <=2.555.2
  • osv-coords2 versions
    pkg:apk/chainguard/jenkins-2.555pkg:bitnami/jenkins
    < 2.555.3-r0+ 1 more
    • (no CPE)range: < 2.555.3-r0
    • (no CPE)range: < 2.555.3

Patches

Vulnerability mechanics

References

19

News mentions

2