CVE-2026-53440: Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"

June 10, 2026 (updated August 13, 2026)

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the “from” parameter in the “Delegate to servlet container” security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.

References

github.com/advisories/GHSA-92m7-4fpw-2wxm
github.com/jenkinsci/jenkins/commit/38071826c9a2113e1104714595262827a87b392f
github.com/jenkinsci/jenkins/commit/c45e93f2d77d94ea3b0545eb5aca32b808a27586
nvd.nist.gov/vuln/detail/CVE-2026-53440
www.jenkins.io/security/advisory/2026-06-10/

Code Behaviors & Features

Detect and mitigate CVE-2026-53440 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →