CVE-2026-33002: DNS Rebinding in Jenkins Core

The core of this vulnerability lies in Jenkins' origin validation mechanism for the CLI WebSocket endpoint. Instead of directly validating the origin header, Jenkins calculates the expected origin based on the Host or X-Forwarded-Host HTTP request headers. A DNS rebinding attack exploits this by manipulating DNS resolution to make a malicious domain appear to resolve to the Jenkins server's IP address. This allows an attacker to craft requests with a seemingly legitimate origin, bypassing the validation and potentially gaining unauthorized access to sensitive data and functionality within the Jenkins environment. The potential impact includes unauthorized code execution, data breaches, and compromise of the entire CI/CD pipeline.

1. Reserved2026-03-17
2. Published2026-03-18
3. Modified2026-04-15
4. EPSS updated2026-03-26

The primary mitigation for CVE-2026-33002 is to upgrade Jenkins Core to version 2.555 or later, which includes the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. One approach is to configure a Web Application Firewall (WAF) or reverse proxy to strictly enforce origin validation rules, rejecting requests with unexpected or suspicious origins. Additionally, review and restrict access to the CLI WebSocket endpoint, limiting it to trusted networks and users. Monitor Jenkins logs for unusual origin patterns that might indicate an attempted DNS rebinding attack.