MEDIUM 4.3
GHSA-92m7-4fpw-2wxm
Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"
Quick fix
GHSA-92m7-4fpw-2wxm — org.jenkins-ci.main:jenkins-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>2.555.3</version> for org.jenkins-ci.main:jenkins-coreDetails
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.jenkins-ci.main:jenkins-core
Introduced in:
0 Fixed in: 2.555.3 Fix
# pom.xml: bump <version>2.555.3</version> for org.jenkins-ci.main:jenkins-core Maven / org.jenkins-ci.main:jenkins-core
Introduced in:
2.556 Fixed in: 2.568 Fix
# pom.xml: bump <version>2.568</version> for org.jenkins-ci.main:jenkins-core References
- https://nvd.nist.gov/vuln/detail/CVE-2026-53440 [ADVISORY]
- https://github.com/jenkinsci/jenkins/commit/38071826c9a2113e1104714595262827a87b392f [WEB]
- https://github.com/jenkinsci/jenkins/commit/c45e93f2d77d94ea3b0545eb5aca32b808a27586 [WEB]
- https://github.com/jenkinsci/jenkins [PACKAGE]
- https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3721 [WEB]