CVE-2026-33002

HIGH

7.5

Descripcion

Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadHIGH

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado3/18/2026

Ultima modificacion3/21/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

jenkins:jenkins

Debilidades (CWE)

CWE-350

Referencias

https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3674(jenkinsci-cert@googlegroups.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.