Jenkins hat eine DNS-Rebinding-Schwachstelle in der WebSocket CLI-Ursprungsvalidierung

The core of this vulnerability lies in Jenkins' origin validation process for the CLI WebSocket endpoint. Normally, Jenkins should verify that requests originate from the expected domain. However, CVE-2026-33002 allows an attacker to manipulate this validation by leveraging DNS rebinding. This technique involves controlling a domain name that initially resolves to the attacker's server, then, through DNS manipulation, resolves to the Jenkins server's IP address. This bypasses the origin check, allowing the attacker to send malicious requests as if they originated from Jenkins itself. The potential impact includes unauthorized code execution, data exfiltration, and complete system compromise, particularly if sensitive credentials or build artifacts are accessible through the Jenkins interface. While not directly analogous to Log4Shell, the ability to bypass security controls and gain unauthorized access shares a similar risk profile.

Organizations heavily reliant on Jenkins for their CI/CD pipelines are particularly at risk. Environments with exposed Jenkins instances or those using shared hosting configurations are also more vulnerable. Any deployment pattern where the Jenkins server's IP address is accessible from untrusted networks should be considered at risk.

• java / server: Monitor Jenkins logs for unusual origin headers or unexpected WebSocket connections. Use a network intrusion detection system (NIDS) to detect DNS rebinding attempts targeting the Jenkins server. • generic web: Use curl to test the CLI WebSocket endpoint with manipulated Host headers to attempt origin bypass.

curl -H "Host: malicious.example.com" http://jenkins-server/cli

1. 2026-03-18Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-03-18
3. Geändert2026-04-15
4. EPSS aktualisiert2026-03-26

The primary mitigation for CVE-2026-33002 is upgrading Jenkins Core to version 2.555 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. One approach is to configure a Web Application Firewall (WAF) or reverse proxy to strictly enforce origin validation rules, rejecting requests with unexpected or manipulated Host headers. Another workaround involves restricting access to the CLI WebSocket endpoint to trusted networks or IP addresses. Carefully review Jenkins' configuration and ensure that X-Forwarded-Host header is not being used for origin validation. After upgrading, verify the fix by attempting a DNS rebinding attack against the CLI WebSocket endpoint using a tool like bettercap or similar DNS rebinding testing frameworks to confirm that origin validation is correctly enforced.