GitHub Advisoryadvisory · Maven

GHSA-92m7-4fpw-2wxm Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"

MEDIUM Published 2026-06-10 Modified 2026-08-13 Official page ↗
Aliases
CVE-2026-53440
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-08-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.555.3 → fixed in 2.555.3 • Maven org.jenkins-ci.main:jenkins-core: >= 2.556, < 2.568 → fixed in 2.568

Description

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.

Related

Alias · CVE (1)

  • CVE-2026-53440 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container"… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References