What is the CVSS score of EUVD-2026-12845?

EUVD-2026-12845 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jenkins are affected by EUVD-2026-12845?

Organizations using validation of requests made face notable risk from CVE-2026-33002 rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-12845?

Within 7 days: Identify all affected systems running validation of requests made and apply vendor patches promptly. Monitor vendor channels for patch availability.

Jenkins EUVD-2026-12845

| CVE-2026-33002 HIGH

Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)

2026-03-18 jenkins

GHSA-phhv-63fh-rrc8

Jenkins Authentication Bypass Red Hat

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

5.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 15:45 euvd

EUVD-2026-12845

Analysis Generated

Mar 18, 2026 - 15:45 vuln.today

CVE Published

Mar 18, 2026 - 15:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.jenkins-ci.main:jenkins-core (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.442.

DescriptionCVE.org

Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.

AnalysisAI

Jenkins versions 2.442 through 2.554 and LTS 2.426.3 through 2.541.2 contain an origin validation bypass vulnerability in the CLI WebSocket endpoint that allows attackers to conduct DNS rebinding attacks. The vulnerability stems from improper use of Host and X-Forwarded-Host headers to compute expected request origins, enabling attackers to bypass authentication controls and potentially execute arbitrary commands through the CLI WebSocket interface. While no CVSS score, EPSS data, or active exploitation in the wild (KEV) status has been publicly disclosed, the vulnerability affects a critical Jenkins component and was responsibly disclosed by the Jenkins security team.

Technical ContextAI

The vulnerability exists in Jenkins' WebSocket CLI endpoint origin validation mechanism, which is responsible for authenticating and authorizing remote command execution requests. The root cause is an inadequate implementation of origin validation that relies on the Host or X-Forwarded-Host HTTP request headers to derive the expected origin for comparison. DNS rebinding attacks exploit this by manipulating DNS resolution to initially resolve to the attacker's server (for initial connection negotiation) and then resolve to the target Jenkins instance, causing the browser or client to make requests that appear to originate from the legitimate Jenkins host according to DNS but are actually controlled by the attacker. This is a form of authentication bypass (CWE-20: Improper Input Validation) where untrusted input from HTTP headers is used to make security decisions without proper validation. The affected CPE is cpe:2.3:a:jenkins_project:jenkins:*:*:*:*:*:*:*:*, confirming that all Jenkins versions within the affected range are impacted.

RemediationAI

Immediately upgrade Jenkins to version 2.555 or later for standard releases, or to LTS version 2.541.3 or later for Long-Term Support releases, as these versions include a fix for the origin validation vulnerability. See the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3674 for detailed upgrade instructions. As an interim mitigation, disable or restrict access to the CLI WebSocket endpoint through network controls (firewall rules, network segmentation) to limit exposure to untrusted networks, and deploy Jenkins behind a reverse proxy that performs strict origin validation independent of Host headers—specifically, configure the proxy to validate request origins against a whitelist and avoid forwarding the X-Forwarded-Host header without strict validation. Additionally, enforce HTTPS with HSTS headers and restrict CLI access to authenticated users from known IP ranges. However, these mitigations are temporary; patching should be prioritized.