CVE-2026-53440 — Jenkins Project / Jenkins

CVE-2026-53440

Jenkins Project / Jenkins PUBLISHED

Description (CNA)

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins	unaffected 2.568 before ; unaffected 2.555.3 before 2.555.

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3721

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.