CVE-2026-33002
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33002?
CVE-2026-33002 is considered a high severity vulnerability due to the potential for unauthorized access through the CLI WebSocket endpoint.
How do I fix CVE-2026-33002?
To address CVE-2026-33002, upgrade Jenkins to version 2.555 or later.
What versions are affected by CVE-2026-33002?
CVE-2026-33002 affects Jenkins versions 2.442 through 2.554 and LTS versions 2.426.3 through 2.541.2.
What is the nature of CVE-2026-33002 vulnerability?
CVE-2026-33002 involves improper origin validation of requests through the CLI WebSocket endpoint, creating a security risk.
Who is impacted by CVE-2026-33002?
Any user or organization using the affected versions of Jenkins, especially those relying on the CLI WebSocket endpoint, is impacted by CVE-2026-33002.