CVE-2026-53440
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.
CSIRTS triage
- What
- This advisory addresses multiple vulnerabilities in Jenkins Core.
- Who is affected
- Deployments of Jenkins Core are affected.
- Urgency
- Remediation is necessary, but the severity is currently unknown.
- Action
- Update to the latest version of Jenkins Core.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-53440
Get an email if CVE-2026-53440 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.
Advisory coverage (2)
- mediumGHSA-92m7-4fpw-2wxm: Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to ser…ghsa · 2026-06-10
- unknownJenkins Security Advisory 2026-06-10jenkins · 2026-06-10
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-53440)