DNS Rebinding Vulnerability in Jenkins WebSocket Endpoint
CVE-2026-33002

7.5HIGH

Key Information:

Vendor

Jenkins
Status
Jenkins
Vendor
CVE Published:
18 March 2026

What is CVE-2026-33002?

Jenkins versions 2.442 to 2.554 and LTS versions 2.426.3 to 2.541.2 are susceptible to DNS rebinding attacks due to improper origin validation. This vulnerability arises from how personal requests through the CLI WebSocket endpoint are validated using the Host or X-Forwarded-Host HTTP request headers. Attackers can leverage this weakness to bypass origin checks, potentially allowing unauthorized access or manipulation of server resources. It is crucial for users to immediately apply patches provided by Jenkins to mitigate this vulnerability and secure their systems.

Affected Version(s)

Jenkins 0

Jenkins 0 < 2.426.3

Jenkins 2.427 < 2.442

References

https://www.jenkins.io/security/advisory/2026-03-18/#SECU...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.