CVE-2026-33002
Jenkins Project Jenkins
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.28 % · percentile 20 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- jenkins
- NVD status
- Analyzed
Description
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.
Weaknesses (CWE)
- CWE-350 — Reliance on Reverse DNS Resolution for a Security-Critical Action
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-phhv-63fh-rrc8 — Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
European references
- ENISA EUVD · EUVD-2026-12845
- GCVE · GCVE-0-2026-33002
Affected configurations (NVD CPE)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*≥ 2.426.3 < 2.541.3cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*≥ 2.442 < 2.555
Affected products
| Product | Versions |
|---|---|
| Jenkins Project · Jenkins | unaffected 0 < 2.426.3 ; unaffected 2.427 < 2.442 ; unaffected 2.555 < * ; unaffected 2.541.3 < 2.541.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |