CVE-2026-53436

Currently unrated

Key Information:

Vendor: Jenkins
Status: Jenkins
Vendor: CVE Published:; 10 June 2026

What is CVE-2026-53436?

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (./ or ../), allowing attackers to perform phishing attacks.

Affected Version(s)

Jenkins 2.568

Jenkins 2.555.3 < 2.555.*

References

https://www.jenkins.io/security/advisory/2026-06-10/#SECU...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 10, 2026
Vulnerability Reserved
Jun 9, 2026

CVE-2026-53436 Data

JSON