GitHub Advisoryadvisory · Maven

GHSA-phhv-63fh-rrc8 Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation

HIGH Published 2026-03-18 Modified 2026-03-19 Official page ↗
Aliases
CVE-2026-33002
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-346, CWE-350
Reviewed
2026-03-19

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 2.442, < 2.555 → fixed in 2.555

Description

Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.

Related

Alias · CVE (1)

  • CVE-2026-33002 Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made… vulnerability

Weakness · CWE (2)

  • CWE-346 Origin Validation Error weakness
  • CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action weakness

References