DNS Rebinding Vulnerability in Jenkins WebSocket Endpoint
CVE-2026-33002

7.5HIGH

Key Information:

Vendor

Jenkins
Status
Jenkins
Vendor
CVE Published:
18 March 2026

What is CVE-2026-33002?

Jenkins versions 2.442 to 2.554 and LTS versions 2.426.3 to 2.541.2 are susceptible to DNS rebinding attacks due to improper origin validation. This vulnerability arises from how personal requests through the CLI WebSocket endpoint are validated using the Host or X-Forwarded-Host HTTP request headers. Attackers can leverage this weakness to bypass origin checks, potentially allowing unauthorized access or manipulation of server resources. It is crucial for users to immediately apply patches provided by Jenkins to mitigate this vulnerability and secure their systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Jenkins 0

Jenkins 0 < 2.426.3

Jenkins 2.427 < 2.442

References

https://www.jenkins.io/security/advisory/2026-03-18/#SECU...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.