CVE-2012-6073: Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.4...

Security readout for executives and security teams

Older Jenkins and Jenkins Enterprise releases could be abused to send users from a trusted Jenkins URL to an attacker-chosen website. The main business risk is phishing: users may trust the Jenkins link and enter credentials elsewhere. The bundle does not show active exploitation or severity scoring. Exposure is likely limited to organizations still running the listed Jenkins or Jenkins Enterprise versions. Internet-facing Jenkins instances, shared CI portals, and environments where users follow Jenkins links from email or chat have higher phishing relevance. Prioritize remediation for internet-facing or widely used Jenkins portals, especially where CI credentials are sensitive. This is not presented as a code execution issue, but it can support credential theft through trusted-brand phishing. Mitigation focus: Upgrade Jenkins to 1.491 or later, or Jenkins LTS to 1.480.1 or later.; Upgrade affected Jenkins Enterprise maintenance lines to the fixed versions named in the advisory.; Review Jenkins, CloudBees, and Red Hat guidance for environment-specific update instructions..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.