CVE-2026-53437 (GCVE-0-2026-53437)

Vulnerability from cvelistv5 – Published: 2026-06-10 13:05 – Updated: 2026-08-27 12:04
VLAI
Summary
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
7.4 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 15:42 UTC
CWE
  • CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
URL Tags
https://www.jenkins.io/security/advisory/2026-06-… vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-53437 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2487544 issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v… x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:60247 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60249 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60248 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60239 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60251 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60246 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60250 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60252 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60259 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60254 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60256 vendor-advisoryx_refsource_REDHAT
Impacted products
Vendor Product Version CPE status
Jenkins Project Jenkins Unaffected: 2.568 , < * (maven)
Unaffected: 2.555.3 , < 2.555.* (maven)
guessed Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.12 Unaffected: 1786628667 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.12::el8
Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.13 Unaffected: 1786628681 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.13::el8
Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.14 Unaffected: 1786533561 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.14::el8
Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.15 Unaffected: 1786533565 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.15::el8
Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.16 Unaffected: 1787125166 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.16::el9
Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.17 Unaffected: 1787124635 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.17::el9
Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.18 Unaffected: 1787125069 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.18::el9
Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.19 Unaffected: 1787124632 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.19::el9
Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.20 Unaffected: 1787124925 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.20::el9
Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.21 Unaffected: 1787125311 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.21::el9
Create a notification for this product.
Red Hat OpenShift Developer Tools and Services 4.22 Unaffected: 1787124779 , < * (rpm)
    cpe:/a:redhat:ocp_tools:4.22::el9
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-53437",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T15:42:49.165047Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-601",
                "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T15:43:26.825Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel8",
            "product": "OpenShift Developer Tools and Services 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628667",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.13::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel8",
            "product": "OpenShift Developer Tools and Services 4.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628681",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.14::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel8",
            "product": "OpenShift Developer Tools and Services 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786533561",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel8",
            "product": "OpenShift Developer Tools and Services 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786533565",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel9",
            "product": "OpenShift Developer Tools and Services 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787125166",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel9",
            "product": "OpenShift Developer Tools and Services 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787124635",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel9",
            "product": "OpenShift Developer Tools and Services 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787125069",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel9",
            "product": "OpenShift Developer Tools and Services 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787124632",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel9",
            "product": "OpenShift Developer Tools and Services 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787124925",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel9",
            "product": "OpenShift Developer Tools and Services 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787125311",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ocp-tools-4/jenkins-rhel9",
            "product": "OpenShift Developer Tools and Services 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787124779",
                "versionType": "rpm"
              }
            ]
          }
        ],
        "datePublic": "2026-06-10T13:05:58.584Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-601",
                "description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T12:04:47.899Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53437"
          },
          {
            "name": "RHBZ#2487544",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60247"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60249"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60248"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60239"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60251"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60246"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60250"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60252"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60259"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60254"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60256"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:60247: OpenShift Developer Tools and Services 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60249: OpenShift Developer Tools and Services 4.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60248: OpenShift Developer Tools and Services 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60239: OpenShift Developer Tools and Services 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60251: OpenShift Developer Tools and Services 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60246: OpenShift Developer Tools and Services 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60250: OpenShift Developer Tools and Services 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60252: OpenShift Developer Tools and Services 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60259: OpenShift Developer Tools and Services 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60254: OpenShift Developer Tools and Services 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60256: OpenShift Developer Tools and Services 4.22"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-10T14:01:45.853Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-10T13:05:58.584Z",
            "value": "Made public."
          }
        ],
        "title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Jenkins",
          "vendor": "Jenkins Project",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.568",
              "versionType": "maven"
            },
            {
              "lessThan": "2.555.*",
              "status": "unaffected",
              "version": "2.555.3",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T13:05:58.584Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "name": "Jenkins Security Advisory 2026-06-10",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2026-53437",
    "datePublished": "2026-06-10T13:05:58.584Z",
    "dateReserved": "2026-06-09T14:26:44.788Z",
    "dateUpdated": "2026-08-27T12:04:47.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53437",
      "date": "2026-08-29",
      "epss": "0.00469",
      "percentile": "0.38634"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53437\",\"sourceIdentifier\":\"jenkinsci-cert@googlegroups.com\",\"published\":\"2026-06-10T14:16:36.677\",\"lastModified\":\"2026-08-27T13:18:24.343\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.\"}],\"affected\":[{\"source\":\"jenkinsci-cert@googlegroups.com\",\"affectedData\":[{\"vendor\":\"Jenkins Project\",\"product\":\"Jenkins\",\"defaultStatus\":\"affected\",\"versions\":[{\"version\":\"2.568\",\"lessThan\":\"*\",\"versionType\":\"maven\",\"status\":\"unaffected\"},{\"version\":\"2.555.3\",\"lessThan\":\"2.555.*\",\"versionType\":\"maven\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.12::el8\"],\"versions\":[{\"version\":\"1786628667\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.13::el8\"],\"versions\":[{\"version\":\"1786628681\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.14::el8\"],\"versions\":[{\"version\":\"1786533561\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.15::el8\"],\"versions\":[{\"version\":\"1786533565\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.16::el9\"],\"versions\":[{\"version\":\"1787125166\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.17::el9\"],\"versions\":[{\"version\":\"1787124635\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.18::el9\"],\"versions\":[{\"version\":\"1787125069\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.19::el9\"],\"versions\":[{\"version\":\"1787124632\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.20\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.20::el9\"],\"versions\":[{\"version\":\"1787124925\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.21::el9\"],\"versions\":[{\"version\":\"1787125311\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.22::el9\"],\"versions\":[{\"version\":\"1787124779\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T15:42:49.165047Z\",\"id\":\"CVE-2026-53437\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-601\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-601\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*\",\"versionEndExcluding\":\"2.555.3\",\"matchCriteriaId\":\"648B5148-FE3B-464A-8963-DCF7ACEF84E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*\",\"versionEndExcluding\":\"2.568\",\"matchCriteriaId\":\"356A970F-6576-49B6-8EBA-E9770ED190A7\"}]}]}],\"references\":[{\"url\":\"https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755\",\"source\":\"jenkinsci-cert@googlegroups.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60239\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60246\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60247\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60248\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60249\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60250\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60251\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60252\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60254\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60256\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60259\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-53437\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2487544\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-26T15:50:18+00:00",
      "cve": "CVE-2026-53437",
      "id": "CVE-2026-53437",
      "initial_release_date": "2026-06-10T13:05:58.584000+00:00",
      "product_status:fixed": "38",
      "product_status:known_not_affected": "38",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"jenkins: Jenkins: Phishing attack via improper redirect URL validation\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628667\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533565\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125166\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124635\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125069\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.20\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124925\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.21\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125311\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-10T14:01:45.853Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-10T13:05:58.584Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:60247: OpenShift Developer Tools and Services 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60239: OpenShift Developer Tools and Services 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60251: OpenShift Developer Tools and Services 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60246: OpenShift Developer Tools and Services 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60250: OpenShift Developer Tools and Services 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60259: OpenShift Developer Tools and Services 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60254: OpenShift Developer Tools and Services 4.21\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-06-10T13:05:58.584Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-53437\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2487544\", \"name\": \"RHBZ#2487544\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60247\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60239\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60251\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60246\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60250\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60259\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60254\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-601\", \"description\": \"URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-26T12:04:57.655Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-53437\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T15:42:49.165047Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-601\", \"description\": \"CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-10T15:41:43.114Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Jenkins Project\", \"product\": \"Jenkins\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.568\", \"lessThan\": \"*\", \"versionType\": \"maven\"}, {\"status\": \"unaffected\", \"version\": \"2.555.3\", \"lessThan\": \"2.555.*\", \"versionType\": \"maven\"}], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755\", \"name\": \"Jenkins Security Advisory 2026-06-10\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.\"}], \"providerMetadata\": {\"orgId\": \"39769cd5-e6e2-4dc8-927e-97b3aa056f5b\", \"shortName\": \"jenkins\", \"dateUpdated\": \"2026-06-10T13:05:58.584Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-53437\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T12:04:57.655Z\", \"dateReserved\": \"2026-06-09T14:26:44.788Z\", \"assignerOrgId\": \"39769cd5-e6e2-4dc8-927e-97b3aa056f5b\", \"datePublished\": \"2026-06-10T13:05:58.584Z\", \"assignerShortName\": \"jenkins\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.