{"cve":"CVE-2026-33002","nvd":{"published":"2026-03-18T16:16:28.187","modified":"2026-06-17T10:36:44.657","status":"Analyzed","description":"Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.5},"cwes":["CWE-350"],"references":["https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3674"],"products":["jenkins:jenkins"],"source":"nvd","synced_at":"2026-10-19T22:26:19.218427112+00:00"},"epss":{"cve":"CVE-2026-33002","score":0.00278,"percentile":0.20251,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-phhv-63fh-rrc8","url":"https://osv.dev/vulnerability/GHSA-phhv-63fh-rrc8","summary":"Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation","modified":"2026-04-16T02:14:28.647144919Z","packages":[{"ecosystem":"Maven","name":"org.jenkins-ci.main:jenkins-core","purl":"pkg:maven/org.jenkins-ci.main/jenkins-core","ranges":[">=2.442 <2.555"],"fixed":["2.555"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}