Jenkins CVE-2026-53440

Exploitation requires that the targeted Jenkins instance is configured to use the 'Delegate to servlet container' security realm - this is a non-default authentication mode that must be explicitly selected by an administrator; Jenkins instances using the built-in user database, LDAP, or other realms are not affected by this specific flaw. The CVSS vector PR:N confirms the attacker requires no account or privileges on the Jenkins instance. UI:R confirms a human victim must click the crafted URL and complete a login session; fully automated exploitation is not possible. Exploitation is further limited to Jenkins versions 2.567 and earlier (weekly) or 2.555.3 and earlier (LTS). The attacker cannot force the redirect without the victim's participation, making mass automated exploitation implausible.

The CVSS 4.3 (Medium) score reflects a network-reachable (AV:N), low-complexity (AC:L), zero-privilege (PR:N) attack that nonetheless requires user interaction (UI:R) and delivers only low integrity impact (I:L) with no confidentiality or availability impact. These vectors are internally consistent: the attacker crafts a URL (no complexity) but must socially engineer a victim to use it. EPSS data is not included in the available intelligence, so exploitation probability cannot be quantified probabilistically. There is no CISA KEV listing and no POC code identified, placing exploitation status at unconfirmed. Despite the modest score, the practical risk to organizations is non-trivial: Jenkins is heavily used by developers and administrators with elevated access to CI/CD pipelines, making phishing via a trusted Jenkins login flow a high-value attack. However, exploitation is bounded by the requirement for the non-default 'Delegate to servlet container' security realm and mandatory victim interaction.

An attacker targeting a Jenkins administrator constructs a login URL such as https://jenkins.corp.example/login?from=https://attacker-phish.com/fake-jenkins and delivers it via a spear-phishing email referencing a pipeline alert or build failure. The victim, trusting the legitimate Jenkins domain in the link, logs in normally and is immediately redirected to the attacker-controlled site, which mirrors the Jenkins interface to harvest credentials or deliver a browser exploit. No public exploit code is identified at time of analysis, and no technical sophistication beyond URL crafting is required.