PT-2026-26074 · Cloudbees+2 · Jenkins+1

Babaucafor · Publicado 2026-03-18 · Atualizado 2026-05-24 · CVE-2026-33002

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.442 through 2.554 Jenkins LTS versions 2.426.3 through 2.541.2

Description The software does not properly validate the origin of requests made through the CLI WebSocket endpoint. It calculates the expected origin using the Host or X-Forwarded-Host HTTP request headers, which can be exploited through DNS rebinding attacks to bypass origin validation.

Recommendations Update to a newer version than 2.554. Update to a newer LTS version than 2.541.2.

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

CWE-350

Identificadores relacionados

BDU:2026-04249

BIT-JENKINS-2026-33002

CVE-2026-33002

GHSA-PHHV-63FH-RRC8

Produtos afetados

Jenkins

Red Os

Referências · 16

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/348666da7136ef8270f88c0a7350562b0ba7f8ce · Nota
• https://osv.dev/vulnerability/CVE-2026-33002 · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2043165222735630761 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-jenkins-2026-33002 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2026-03-18/#SECURITY-3674 · Aviso do Fabricante
• https://twitter.com/autumn_good_35/status/2035397193222508898 · Publicação no Twitter
• https://twitter.com/AndreGironda/status/2034745679927775725 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-04249 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-33002 · Nota de Segurança
• https://redos.red-soft.ru/search/?iblock_id=&q=CVE-2026-33002 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-jenkins-cve-2026-33002-7.3 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-jenkins-cve-2026-33002-8.0 · Nota
• https://osv.dev/vulnerability/GHSA-phhv-63fh-rrc8 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034365285231427726 · Publicação no Twitter