logo

Database

Uncontrolled external site redirect In org.jenkins-ci.main:jenkins-core

Description

Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between //, allowing attackers to perform phishing attacks.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-534372. NVD-2026-534373. OSV-2026-534374. GCVE-2026-534375. SECURITY-cve-2026-53437.json6. ACCESS-CVE-2026-534377. access.redhat.com8. access.redhat.com9. access.redhat.com10. access.redhat.com11. access.redhat.com12. access.redhat.com13. access.redhat.com14. access.redhat.com15. access.redhat.com16. access.redhat.com17. access.redhat.com

References

1. https://github.com/jenkinsci/jenkins/commit/b32f2f27a82ed187a34f55b05edcc4a83563d5742. https://github.com/jenkinsci/jenkins/commit/8ef52891b07eb639b38271e4bab5dab3c0f10fda3. https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+37554. https://bugzilla.redhat.com/show_bug.cgi?id=2487544

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.