Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation

The core of this vulnerability lies in Jenkins' origin validation mechanism for the CLI WebSocket endpoint. Instead of directly validating the origin header, Jenkins calculates the expected origin based on the Host or X-Forwarded-Host HTTP request headers. A DNS rebinding attack exploits this by manipulating DNS resolution to make a malicious domain appear to resolve to the Jenkins server's IP address. This allows an attacker to craft requests with a seemingly legitimate origin, bypassing the validation and potentially gaining unauthorized access to sensitive data and functionality within the Jenkins environment. The potential impact includes unauthorized code execution, data breaches, and compromise of the entire CI/CD pipeline.

Organizations heavily reliant on Jenkins for their CI/CD pipelines are particularly at risk. Environments with exposed Jenkins instances or those using shared hosting configurations are also more vulnerable. Any deployment pattern where the Jenkins server's IP address is accessible from untrusted networks should be considered at risk.

• java / server: Monitor Jenkins logs for unusual origin headers or unexpected WebSocket connections. Use a network intrusion detection system (NIDS) to detect DNS rebinding attempts targeting the Jenkins server. • generic web: Use curl to test the CLI WebSocket endpoint with manipulated Host headers to attempt origin bypass.

curl -H "Host: malicious.example.com" http://jenkins-server/cli

1. 2026-03-18Disclosure

   disclosure

1. आरक्षित2026-03-17
2. प्रकाशित2026-03-18
3. संशोधित2026-04-15
4. EPSS अद्यतन2026-03-26

The primary mitigation for CVE-2026-33002 is to upgrade Jenkins Core to version 2.555 or later, which includes the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. One approach is to configure a Web Application Firewall (WAF) or reverse proxy to strictly enforce origin validation rules, rejecting requests with unexpected or suspicious origins. Additionally, review and restrict access to the CLI WebSocket endpoint, limiting it to trusted networks and users. Monitor Jenkins logs for unusual origin patterns that might indicate an attempted DNS rebinding attack.