CVE-2026-53436: Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL

June 10, 2026 (updated August 13, 2026)

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (./ or ../), allowing attackers to perform phishing attacks.

References

github.com/advisories/GHSA-3rqh-hch3-jhpc
github.com/jenkinsci/jenkins/commit/8ef52891b07eb639b38271e4bab5dab3c0f10fda
github.com/jenkinsci/jenkins/commit/b32f2f27a82ed187a34f55b05edcc4a83563d574
nvd.nist.gov/vuln/detail/CVE-2026-53436
www.jenkins.io/security/advisory/2026-06-10/

Code Behaviors & Features

Detect and mitigate CVE-2026-53436 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →