CVE-2026-33002
Jenkins Project Jenkins
HIGH 7.5
En bref
- Source
- NVD
- EPSS
- EPSS 0.28 % · centile 20 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- jenkins
- Statut NVD
- Analyzed
Description
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.
Faiblesses (CWE)
- CWE-350 — Reliance on Reverse DNS Resolution for a Security-Critical Action
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- GHSA-phhv-63fh-rrc8 — Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
Références européennes
- ENISA EUVD · EUVD-2026-12845
- GCVE · GCVE-0-2026-33002
Configurations affectées (CPE NVD)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*≥ 2.426.3 < 2.541.3cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*≥ 2.442 < 2.555
Produits affectés
| Produit | Versions |
|---|---|
| Jenkins Project · Jenkins | unaffected 0 < 2.426.3 ; unaffected 2.427 < 2.442 ; unaffected 2.555 < * ; unaffected 2.541.3 < 2.541.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |