CVE-2026-53437

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53437", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2026-06-09T14:26:44.788Z", "datePublished": "2026-06-10T13:05:58.584Z", "dateUpdated": "2026-09-09T12:04:50.981Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2026-06-10T13:05:58.584Z"}, "affected": [{"vendor": "Jenkins Project", "product": "Jenkins", "versions": [{"version": "2.568", "versionType": "maven", "lessThan": "*", "status": "unaffected"}, {"version": "2.555.3", "versionType": "maven", "lessThan": "2.555.*", "status": "unaffected"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks."}], "references": [{"name": "Jenkins Security Advisory 2026-06-10", "url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755", "tags": ["vendor-advisory"]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-601", "lang": "en", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-10T15:42:49.165047Z", "id": "CVE-2026-53437", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T15:43:26.825Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.12::el8"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel8", "product": "OpenShift Developer Tools and Services 4.12", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786628667", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.13::el8"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel8", "product": "OpenShift Developer Tools and Services 4.13", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786628681", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.14::el8"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel8", "product": "OpenShift Developer Tools and Services 4.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786533561", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.15::el8"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel8", "product": "OpenShift Developer Tools and Services 4.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786533565", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.16::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787125166", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.17::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787124635", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.18::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787125069", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.19::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.19", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787124632", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.20::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787124925", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.21::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.21", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787125311", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.22::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.22", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787124779", "versionType": "rpm"}]}], "datePublic": "2026-06-10T13:05:58.584Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "description": "URL Redirection to Untrusted Site ('Open Redirect')", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-53437"}, {"name": "RHBZ#2487544", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60247"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60249"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60248"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60239"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60251"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60246"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60250"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60252"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60259"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60254"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:60256"}], "solutions": [{"lang": "en", "value": "RHSA-2026:60247: OpenShift Developer Tools and Services 4.12"}, {"lang": "en", "value": "RHSA-2026:60249: OpenShift Developer Tools and Services 4.13"}, {"lang": "en", "value": "RHSA-2026:60248: OpenShift Developer Tools and Services 4.14"}, {"lang": "en", "value": "RHSA-2026:60239: OpenShift Developer Tools and Services 4.15"}, {"lang": "en", "value": "RHSA-2026:60251: OpenShift Developer Tools and Services 4.16"}, {"lang": "en", "value": "RHSA-2026:60246: OpenShift Developer Tools and Services 4.17"}, {"lang": "en", "value": "RHSA-2026:60250: OpenShift Developer Tools and Services 4.18"}, {"lang": "en", "value": "RHSA-2026:60252: OpenShift Developer Tools and Services 4.19"}, {"lang": "en", "value": "RHSA-2026:60259: OpenShift Developer Tools and Services 4.20"}, {"lang": "en", "value": "RHSA-2026:60254: OpenShift Developer Tools and Services 4.21"}, {"lang": "en", "value": "RHSA-2026:60256: OpenShift Developer Tools and Services 4.22"}], "timeline": [{"lang": "en", "time": "2026-06-10T14:01:45.853Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-10T13:05:58.584Z", "value": "Made public."}], "title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-09T12:04:50.981Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:ocp_tools:4.12::el8"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.12", "versions": [{"status": "unaffected", "version": "1786628667", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools:4.13::el8"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.13", "versions": [{"status": "unaffected", "version": "1786628681", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools:4.14::el8"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.14", "versions": [{"status": "unaffected", "version": "1786533561", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools:4.15::el8"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.15", "versions": [{"status": "unaffected", "version": "1786533565", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools:4.16::el9"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.16", "versions": [{"status": "unaffected", "version": "1787125166", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools:4.17::el9"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.17", "versions": [{"status": "unaffected", "version": "1787124635", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools:4.18::el9"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.18", "versions": [{"status": "unaffected", "version": "1787125069", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools:4.19::el9"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.19", "versions": [{"status": "unaffected", "version": "1787124632", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools:4.20::el9"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.20", "versions": [{"status": "unaffected", "version": "1787124925", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools:4.21::el9"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.21", "versions": [{"status": "unaffected", "version": "1787125311", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ocp_tools:4.22::el9"], "vendor": "Red Hat", "product": "OpenShift Developer Tools and Services 4.22", "versions": [{"status": "unaffected", "version": "1787124779", "lessThan": "*", "versionType": "rpm"}], "packageName": "ocp-tools-4/jenkins-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-06-10T14:01:45.853Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-10T13:05:58.584Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:60247: OpenShift Developer Tools and Services 4.12"}, {"lang": "en", "value": "RHSA-2026:60249: OpenShift Developer Tools and Services 4.13"}, {"lang": "en", "value": "RHSA-2026:60248: OpenShift Developer Tools and Services 4.14"}, {"lang": "en", "value": "RHSA-2026:60239: OpenShift Developer Tools and Services 4.15"}, {"lang": "en", "value": "RHSA-2026:60251: OpenShift Developer Tools and Services 4.16"}, {"lang": "en", "value": "RHSA-2026:60246: OpenShift Developer Tools and Services 4.17"}, {"lang": "en", "value": "RHSA-2026:60250: OpenShift Developer Tools and Services 4.18"}, {"lang": "en", "value": "RHSA-2026:60252: OpenShift Developer Tools and Services 4.19"}, {"lang": "en", "value": "RHSA-2026:60259: OpenShift Developer Tools and Services 4.20"}, {"lang": "en", "value": "RHSA-2026:60254: OpenShift Developer Tools and Services 4.21"}, {"lang": "en", "value": "RHSA-2026:60256: OpenShift Developer Tools and Services 4.22"}], "x_adpType": "supplier", "datePublic": "2026-06-10T13:05:58.584Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-53437", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544", "name": "RHBZ#2487544", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60247", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60249", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60248", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60239", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60251", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60246", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60250", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60252", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60259", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60254", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60256", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-07T12:04:50.709Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-53437", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T15:42:49.165047Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T15:41:43.114Z"}}], "cna": {"affected": [{"vendor": "Jenkins Project", "product": "Jenkins", "versions": [{"status": "unaffected", "version": "2.568", "lessThan": "*", "versionType": "maven"}, {"status": "unaffected", "version": "2.555.3", "lessThan": "2.555.*", "versionType": "maven"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755", "name": "Jenkins Security Advisory 2026-06-10", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2026-06-10T13:05:58.584Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53437", "state": "PUBLISHED", "dateUpdated": "2026-09-07T12:04:50.709Z", "dateReserved": "2026-06-09T14:26:44.788Z", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "datePublished": "2026-06-10T13:05:58.584Z", "assignerShortName": "jenkins"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Jenkins", "vendor": "Jenkins Project", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.568", "versionType": "maven"}, {"lessThan": "2.555.*", "status": "unaffected", "version": "2.555.3", "versionType": "maven"}]}], "source": "jenkinsci-cert@googlegroups.com"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.12::el8"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel8", "product": "OpenShift Developer Tools and Services 4.12", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786628667", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.13::el8"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel8", "product": "OpenShift Developer Tools and Services 4.13", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786628681", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.14::el8"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel8", "product": "OpenShift Developer Tools and Services 4.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786533561", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.15::el8"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel8", "product": "OpenShift Developer Tools and Services 4.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786533565", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.16::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787125166", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.17::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787124635", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.18::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787125069", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.19::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.19", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787124632", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.20::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787124925", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.21::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.21", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787125311", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ocp_tools:4.22::el9"], "defaultStatus": "affected", "packageName": "ocp-tools-4/jenkins-rhel9", "product": "OpenShift Developer Tools and Services 4.22", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787124779", "versionType": "rpm"}]}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*", "matchCriteriaId": "648B5148-FE3B-464A-8963-DCF7ACEF84E5", "versionEndExcluding": "2.555.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*", "matchCriteriaId": "356A970F-6576-49B6-8EBA-E9770ED190A7", "versionEndExcluding": "2.568", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks."}, {"lang": "es", "value": "Jenkins 2.567 y anteriores, LTS 2.555.2 y anteriores determina incorrectamente que una URL de redirecci\u00f3n despu\u00e9s del inicio de sesi\u00f3n apunta leg\u00edtimamente a Jenkins cuando contiene caracteres de tabulaci\u00f3n o de nueva l\u00ednea entre \u2019//\u2019, lo que permite a los atacantes realizar ataques de phishing."}], "id": "CVE-2026-53437", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53437", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-10T15:42:49.165047Z", "version": "2.0.3"}}]}, "published": "2026-06-10T14:16:36.677", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60239"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60246"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60247"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60248"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60249"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60250"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60251"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60252"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60254"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60256"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:60259"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-53437"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53437.json"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-601"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "jenkins: Jenkins: Phishing attack via improper redirect URL validation", "id": "2487544", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-601", "details": ["A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-53437", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "jenkins", "product_name": "OpenShift Developer Tools and Services"}], "public_date": "2026-06-10T13:05:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53437\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53437\nhttps://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"], "statement": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools & Services.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[2.568,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[2.555.3,2.556.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Jenkins", "source": "cna", "vendor": "Jenkins Project"}, "product": "jenkins", "vendor": "jenkins_project"}], "created": "2026-06-10T15:00:13.772028+00:00", "updated": "2026-06-10T17:30:36.303595+00:00", "vendors": ["jenkins_project", "jenkins_project$PRODUCT$jenkins"]}