CVE-2026-92141: Jenkins Keycloak Auth Bypass Vulnerability

CVE-2026-92141 Overview

CVE-2026-92141 is an open redirect vulnerability in the Jenkins Keycloak Authentication Plugin version 2.4.1 and earlier. The plugin fails to restrict the redirect URL after a successful login, allowing attackers to craft authentication links that redirect users to attacker-controlled destinations. This weakness enables phishing attacks that abuse the trust of the Jenkins login domain to harvest credentials or deliver malicious payloads. The issue is tracked as CWE-601: URL Redirection to Untrusted Site and disclosed in the Jenkins Security Advisory #SECURITY-3767.

Critical Impact
Attackers can send authenticated Jenkins users to malicious external sites after login, enabling credential theft and drive-by malware delivery through trusted Jenkins URLs.

Affected Products

Jenkins Keycloak Authentication Plugin versions 2.4.1 and earlier
Jenkins controllers integrating Keycloak single sign-on through the affected plugin
CI/CD environments relying on Keycloak-managed identities for Jenkins authentication

Discovery Timeline

2026-09-16 - CVE CVE-2026-92141 published to NVD
2026-09-16 - Jenkins Security Advisory #SECURITY-3767 released
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92141

Vulnerability Analysis

The Jenkins Keycloak Authentication Plugin accepts a post-login redirect parameter and forwards the browser to that URL without validating whether the target belongs to the Jenkins instance. An attacker constructs a login URL that references a Jenkins host but contains a redirect parameter pointing to an external domain. When a legitimate user completes authentication, the browser lands on the attacker's site while retaining the visual context of a successful Jenkins login.

This behavior is a classic open redirect classified under CWE-601. Exploitation requires user interaction, so campaigns typically arrive through email, chat, or search-engine links. The vulnerability does not directly grant access to Jenkins data, but it enables phishing pages that convincingly mimic Jenkins or Keycloak login prompts to capture credentials or multi-factor tokens.

Root Cause

The root cause is missing allowlist validation on the redirect URL used after Keycloak authentication completes. The plugin trusts a client-supplied parameter and issues an HTTP redirect without confirming that the destination shares the Jenkins origin. See the Jenkins Security Advisory #SECURITY-3767 for the vendor's technical description.

Attack Vector

Exploitation occurs over the network and requires the victim to click a crafted link. An attacker embeds a malicious redirect target in a Jenkins login URL, distributes the link through phishing, and waits for a user to authenticate. After the redirect fires, the attacker-controlled site can prompt for credentials, deliver malware, or pivot to further social engineering. No prior privileges on the Jenkins controller are required.

No verified proof-of-concept code has been published. The vulnerability is described in prose only; see the vendor advisory for parameter-level details.

Detection Methods for CVE-2026-92141

Indicators of Compromise

Outbound HTTP 302 responses from Jenkins login endpoints referencing external hostnames in the Location header
Access log entries containing login URLs with redirect or from parameters pointing to non-Jenkins domains
User reports of unexpected redirects to unfamiliar login prompts immediately after signing in to Jenkins
Spikes in short-lived sessions or authentication attempts followed by traffic to newly registered domains

Detection Strategies

Parse Jenkins access logs for authentication URLs that include absolute URLs or protocol-relative values in redirect parameters
Correlate Keycloak authentication events with subsequent HTTP redirects that leave the Jenkins origin
Alert on user-agent flows that complete Jenkins login and immediately request resources on unrelated external domains
Compare the installed Jenkins Keycloak Authentication Plugin version against 2.4.1 across all controllers

Monitoring Recommendations

Ingest Jenkins controller and reverse-proxy logs into a centralized analytics platform for redirect-parameter inspection
Monitor DNS and proxy telemetry for newly observed domains referenced by Jenkins login traffic
Track plugin inventory changes so unpatched Keycloak Authentication Plugin instances surface in vulnerability dashboards
Enable phishing telemetry from email and web gateways to catch inbound links targeting Jenkins login endpoints

How to Mitigate CVE-2026-92141

Immediate Actions Required

Inventory every Jenkins controller and identify installations of the Keycloak Authentication Plugin at version 2.4.1 or earlier
Restrict Jenkins login endpoints behind authenticated network paths or VPN where feasible until the plugin is updated
Warn Jenkins users about phishing links that reference legitimate Jenkins hostnames but redirect elsewhere after login
Review Keycloak client configurations to ensure valid redirect URIs are tightly scoped to Jenkins origins

Patch Information

Refer to the Jenkins Security Advisory #SECURITY-3767 for the fixed plugin release. Upgrade the Keycloak Authentication Plugin to the version identified in the advisory, then restart the Jenkins controller and verify the plugin version in Manage Jenkins → Plugins.

Workarounds

Place Jenkins behind a reverse proxy that strips or validates redirect parameters against an allowlist of internal hostnames
Disable the Keycloak Authentication Plugin and revert to an alternative authentication realm until the patched release is deployed
Enforce strict Content Security Policy and browser-level phishing protections for users who access Jenkins

bash

# Configuration example: list installed plugin versions via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep -i keycloak