GitHub Advisoryadvisory · Maven

GHSA-3rqh-hch3-jhpc Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL

MEDIUM Published 2026-06-10 Modified 2026-08-13 Official page ↗
Aliases
CVE-2026-53436
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-08-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 2.556, < 2.568 → fixed in 2.568 • Maven org.jenkins-ci.main:jenkins-core: < 2.555.3 → fixed in 2.555.3

Description

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (`./` or `../`), allowing attackers to perform phishing attacks.

Related

Alias · CVE (1)

  • CVE-2026-53436 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References