Jenkins CVE-2026-33002

Jenkins 2.442–2.554 or LTS 2.426.3–2.541.2 with CLI WebSocket endpoint accessible. Requires victim to click attacker-crafted link or visit malicious page. Attacker performs DNS rebinding to bypass origin validation. No authentication required.

Although CVSS and EPSS scores are not provided, this vulnerability warrants high-priority remediation based on available signals. The attack vector appears to be network-based and likely requires low attack complexity, as it leverages standard DNS rebinding techniques that are well-understood in the security community. The technical impact is severe, as successful exploitation grants access to the CLI WebSocket endpoint which typically permits command execution with Jenkins' privilege level. The vulnerability affects a widely deployed open-source automation platform used across enterprise environments for CI/CD. The fact that this was identified and publicly disclosed by the Jenkins security team through a formal advisory (rather than discovered through active exploitation) suggests responsible disclosure, but the absence of KEV status and public POC does not diminish the real-world risk—Jenkins instances exposed to untrusted networks or behind certain proxy configurations are particularly vulnerable. The vulnerability is likely automatable, as DNS rebinding attacks can be executed programmatically. Prioritization should treat this as critical for any Jenkins instance that accepts CLI WebSocket connections from untrusted networks.

An attacker registers a domain (e.g., attacker.com) and crafts a DNS rebinding payload that first resolves to the attacker's server, allowing the initial WebSocket handshake to appear legitimate from the perspective of the Jenkins CLI client. The attacker then modifies DNS responses so that subsequent requests to the same domain resolve to the target Jenkins instance's IP address. When the Jenkins WebSocket endpoint validates the origin using the Host header, it accepts requests as legitimate because the Host header reflects the attacker-controlled domain that now resolves to the Jenkins instance. The attacker can then send CLI commands through the WebSocket connection without proper origin validation, potentially executing arbitrary commands with Jenkins' privileges. No public proof-of-concept code has been widely disclosed, but DNS rebinding techniques are well-documented, making exploitation feasible for skilled attackers targeting exposed Jenkins instances.