CVE-2026-53437: Jenkins Auth Bypass Vulnerability

CVE-2026-53437 Overview

Jenkins contains an open redirect vulnerability that allows attackers to craft URLs that redirect users to external sites after login. The flaw affects Jenkins 2.567 and earlier, as well as LTS 2.555.2 and earlier. The application improperly validates redirect URLs when the URL contains tab or newline characters between //. Attackers can leverage this weakness to conduct phishing attacks against authenticated Jenkins users. The vulnerability is classified under [CWE-601] (URL Redirection to Untrusted Site).

Critical Impact
Attackers can craft redirect URLs that bypass Jenkins origin validation, enabling phishing campaigns that appear to originate from a trusted Jenkins instance.

Affected Products

Jenkins 2.567 and earlier
Jenkins LTS 2.555.2 and earlier
Jenkins web login redirect handler

Discovery Timeline

2026-06-10 - CVE CVE-2026-53437 published to NVD
2026-06-10 - Jenkins Security Advisory 2026-06-10 released
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-53437

Vulnerability Analysis

The vulnerability resides in Jenkins login flow logic that determines whether a post-login redirect URL points back to the Jenkins instance. The validation routine inspects the URL structure to confirm it represents an internal Jenkins path rather than an external destination. When the URL contains tab (\t) or newline (\n, \r) characters between the // sequence, the validation logic misinterprets the URL as legitimate. Browsers, however, strip these whitespace characters before navigation and follow the URL to an attacker-controlled domain.

Exploitation requires user interaction. A victim must click a crafted link that appears to point to a legitimate Jenkins server. After authenticating, the browser executes the redirect to the attacker domain. The attacker can then host a convincing replica of the Jenkins interface to harvest credentials or session tokens.

Root Cause

The root cause is improper URL parsing in the redirect validation function. Jenkins compares URL components without normalizing whitespace characters that browsers ignore during navigation. This mismatch between server-side validation and browser-side URL handling creates the bypass condition described in [CWE-601].

Attack Vector

Attackers deliver crafted URLs through email, chat, or external websites. The URL contains a from or similar redirect parameter encoding a destination such as //\t\tattacker.example.com. Jenkins validates the parameter, treats it as a relative path, and issues an HTTP redirect after authentication. The browser normalizes the URL and sends the user to the attacker domain.

No verified public exploit code is available. Refer to the Jenkins Security Advisory June 2026 for additional technical context.

Detection Methods for CVE-2026-53437

Indicators of Compromise

HTTP request logs containing redirect parameters with embedded tab, carriage return, or newline characters between // sequences
Login redirects in Jenkins access logs pointing to external domains rather than internal Jenkins paths
Spike in authentication events followed by 302 responses to non-Jenkins hosts

Detection Strategies

Parse Jenkins access logs for from= parameters containing URL-encoded whitespace such as %09, %0A, or %0D adjacent to slash characters
Alert on outbound redirects where the Location header references a domain outside the configured Jenkins root URL
Correlate phishing reports from users with Jenkins login activity timestamps

Monitoring Recommendations

Enable verbose access logging on Jenkins reverse proxies and forward to a centralized log platform
Track all 30x responses originating from /login and /securityRealm/ endpoints
Monitor for inbound links to Jenkins containing suspicious redirect parameters in email security gateways

How to Mitigate CVE-2026-53437

Immediate Actions Required

Upgrade Jenkins to a version newer than 2.567 or Jenkins LTS to a version newer than 2.555.2
Audit recent login activity for redirects to unexpected external hosts
Notify Jenkins users to verify the browser address bar after authentication and report suspicious redirects

Patch Information

Jenkins addressed the issue in releases published alongside the Jenkins Security Advisory June 2026. The fix tightens URL validation by rejecting redirect targets that contain whitespace characters within the authority component. Administrators should apply the patched release through standard Jenkins update channels.

Workarounds

Deploy a reverse proxy rule that strips or rejects requests containing whitespace characters in redirect parameters
Restrict Jenkins login redirects to an allowlist of internal paths using web application firewall policies
Train users to inspect post-login URLs and report unexpected domain changes

bash

# Example NGINX rule to block redirect parameters containing encoded whitespace
if ($args ~* "from=[^&]*(%09|%0A|%0D)") {
    return 400;
}