CVE-2026-53440: Jenkins Open Redirect Phishing Vulnerability (CVSS 4.3)

Technical summary

The vulnerability exists in Jenkins' handling of the "from" parameter within the servlet container delegation security realm. When users authenticate via this realm, the application does not properly sanitize or validate the redirect target before performing a post-login redirect. This open redirect (CWE-601) allows attackers to supply arbitrary URLs that will be followed by authenticated users, creating a trusted-origin phishing vector. The issue affects Jenkins 2.567 and all earlier versions, as well as LTS releases up to 2.555.2.

Business impact

Organizations using Jenkins for CI/CD pipeline management face elevated phishing risk targeting their development and operations staff. Compromised Jenkins credentials could lead to unauthorized pipeline execution, artifact tampering, or lateral movement into connected systems. The attack requires user interaction but exploits the inherent trust users place in post-login redirects from their own authentication system, making it particularly effective in social engineering campaigns.

Affected systems

All Jenkins instances running version 2.567 or earlier are vulnerable, including users of the LTS release stream (2.555.2 and earlier). The vulnerability applies specifically when using the "Delegate to servlet container" security realm configuration. Organizations using alternative authentication backends (LDAP, AD, or other security realms) are not affected by this particular flaw.

Exploitability

The attack has a low barrier to entry: an attacker needs only to craft a specially-formed Jenkins login URL containing a malicious "from" parameter and distribute it through social engineering. The CVSS score of 4.3 (Medium) reflects that exploitation requires user interaction and causes integrity impact only (no confidentiality or availability loss). However, the low technical complexity and ubiquity of Jenkins in development environments means this could see widespread exploitation if actively weaponized.

Remediation

Jenkins administrators should upgrade to patched releases as soon as they become available. Verify against the official Jenkins security advisory for the specific patched version numbers for both the main release line and LTS. As an interim mitigation, restrict external access to Jenkins login pages, enforce multi-factor authentication to reduce phishing effectiveness, and educate users to verify redirect destinations match expected Jenkins infrastructure before entering credentials.

Patch guidance

Monitor the Jenkins project security advisories for release announcements. Patched versions will be released for both the main release line (above 2.567) and the LTS track (above 2.555.2). Apply updates during your standard maintenance windows, prioritizing systems with public internet exposure or high-value CI/CD responsibilities. Test patched versions in a staging environment to confirm compatibility with your existing plugins and workflows before production deployment.

Detection guidance

Monitor Jenkins access logs for the "from" parameter containing non-local domains or suspicious hostnames. Alert on authentication events followed by redirects to external URLs. Review proxy or WAF logs for POST requests to Jenkins login endpoints with unusual redirect targets. Track which Jenkins security realm configurations are in use across your infrastructure to identify instances using the vulnerable "Delegate to servlet container" setting. Implement network segmentation to limit Jenkins' ability to redirect users to arbitrary external sites.

Why prioritize this

This vulnerability merits prompt attention despite its Medium CVSS score because it directly targets user trust in internal authentication systems. Jenkins instances exposed to the internet or used by numerous developers should be patched first. Organizations in regulated industries or with strict security postures should prioritize this to maintain authentication integrity and reduce phishing surface area. The low attack complexity and reliance on social engineering rather than technical sophistication make it a realistic threat in targeted campaigns.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects an open redirect with user interaction required (UI:R) and integrity impact only (I:L). The score appropriately excludes confidentiality and availability losses because the vulnerability enables phishing rather than direct data theft or service disruption. However, the contextual risk is elevated for organizations where Jenkins operators have elevated privileges, where phishing success could cascade into broader system compromise. The lack of KEV designation indicates this is not yet observed in active, widespread exploitation, providing a window for proactive patching.

Frequently asked questions