PT-2026-26074 · Cloudbees+2 · Jenkins+1

Babaucafor · Published 2026-03-18 · Updated 2026-05-24 · CVE-2026-33002

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.442 through 2.554 Jenkins LTS versions 2.426.3 through 2.541.2

Description The software does not properly validate the origin of requests made through the CLI WebSocket endpoint. It calculates the expected origin using the Host or X-Forwarded-Host HTTP request headers, which can be exploited through DNS rebinding attacks to bypass origin validation.

Recommendations Update to a newer version than 2.554. Update to a newer LTS version than 2.541.2.

Fix

Origin Validation Error

Weakness Enumeration

CWE-350

CWE-346

Related Identifiers

BDU:2026-04249

BIT-JENKINS-2026-33002

CVE-2026-33002

GHSA-PHHV-63FH-RRC8

Affected Products

Jenkins

Red Os

References · 16

• https://jenkins.io/security/advisory/2026-03-18/#SECURITY-3674 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-phhv-63fh-rrc8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33002 · Security Note
• https://osv.dev/vulnerability/BIT-jenkins-2026-33002 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04249 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33002 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/348666da7136ef8270f88c0a7350562b0ba7f8ce · Note
• https://twitter.com/the_yellow_fall/status/2034643555822789029 · Twitter Post
• https://twitter.com/pulsepatchio/status/2043165222735630761 · Twitter Post
• https://twitter.com/CVEnew/status/2034365285231427726 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-jenkins-cve-2026-33002-8.0 · Note
• https://twitter.com/AndreGironda/status/2034745679927775725 · Twitter Post
• https://redos.red-soft.ru/search/?iblock_id=&q=CVE-2026-33002 · Note
• https://twitter.com/autumn_good_35/status/2035397193222508898 · Twitter Post