Vulnerability in Jenkins
CVE-2026-33002
Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (38.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.002
Affected products
- Jenkins
- Jenkins Project — versions 0, 2.427, 2.555
Weakness classification (CWE)
References
- www.jenkins.io/security/advisory/2026-03-18/ (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-33002?
- CVE-2026-33002 is a high-severity vulnerability in Jenkins, classified under CWE-350. CVSS score: 7.5/10. Published 2026-03-18.
- How severe is CVE-2026-33002?
- High severity. CVSS v3 base score is 7.5 out of 10.