CVE-2026-33002

State: Published
Severity: 7.5 High
Published: Mar 18, 2026
Updated: Mar 19, 2026
Reserved: Mar 17, 2026

Description

Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action

Affected Products

Product	Versions
JenkinsJenkins Project	before 2.426.3Not affected 2.427 to before 2.442Not affected 2.555 and laterNot affected 2.541.3 to before 2.541.*Not affected

References

Jenkins Security Advisory 2026-03-18vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.