CVE-2026-33002: 
Java vulnerability analysis and mitigation

CVE-2026-33002 is a DNS rebinding vulnerability in Jenkins' CLI WebSocket endpoint origin validation, tracked as SECURITY-3674. It affects Jenkins weekly versions 2.442 through 2.554 (inclusive) and LTS versions 2.426.3 through 2.541.2 (inclusive). The flaw was disclosed on March 18, 2026, via the Jenkins Security Advisory. It carries a CVSS v3.1 base score of 7.5 (High) (Jenkins Advisory, Red Hat Bugzilla).

The root cause is an origin validation error (CWE-346) combined with reliance on reverse DNS resolution for a security-critical action (CWE-350). Jenkins computes the expected WebSocket origin by reading the Host or X-Forwarded-Host HTTP request headers rather than using the configured Jenkins URL, making it susceptible to DNS rebinding (CAPEC-275). An attacker can set up a malicious website whose domain initially resolves to the attacker's server, then re-resolves to the Jenkins controller's IP address; the victim's browser then sends WebSocket upgrade requests with an Origin header matching the attacker's domain, which Jenkins incorrectly accepts. Exploitation requires Jenkins to be accessible over plain HTTP (not HTTPS) and the CLI WebSocket endpoint to be reachable, and it requires user interaction (victim visiting the malicious site) (Jenkins Advisory).

Successful exploitation allows an attacker to establish a WebSocket connection to the Jenkins CLI endpoint from an untrusted origin and execute CLI commands as the anonymous user. If the anonymous user has elevated permissions (e.g., "Anyone can do anything" authorization strategy), the attacker can execute arbitrary Groovy scripts via the groovy or groovysh CLI commands, resulting in full remote code execution on the Jenkins controller with high confidentiality, integrity, and availability impact. Even with minimal anonymous permissions, an attacker can enumerate information about the Jenkins instance. Jenkins controllers on private networks with permissive anonymous access are at greatest risk (Jenkins Advisory).

1. Reconnaissance: Identify Jenkins instances accessible over plain HTTP (not HTTPS) on private or internal networks, particularly those with permissive anonymous user permissions (e.g., "Anyone can do anything" authorization strategy).
2. Set up DNS rebinding infrastructure: Register a domain and configure a DNS server with a very short TTL (e.g., 1 second). Initially, the domain resolves to the attacker's own server IP.
3. Host malicious webpage: Serve a webpage from the attacker's domain that contains JavaScript to initiate a WebSocket connection to the Jenkins CLI WebSocket endpoint (/cli/ws).
4. Trigger DNS rebinding: After the victim loads the page and the initial DNS TTL expires, update the DNS record to resolve the attacker's domain to the Jenkins controller's IP address.
5. Establish WebSocket connection: The victim's browser, now resolving the attacker's domain to the Jenkins IP, sends a WebSocket upgrade request with Origin: http://attacker-domain.com. Jenkins validates the origin using the Host header (which also reflects the attacker's domain due to rebinding), incorrectly accepting the connection.
6. Execute CLI commands: Through the established WebSocket CLI connection, send Jenkins CLI commands as the anonymous user. If the anonymous user has sufficient permissions, execute Groovy scripts (e.g., groovy command) to achieve arbitrary code execution on the Jenkins controller (Jenkins Advisory).

• Network: Unexpected WebSocket upgrade requests to /cli/ws from unusual or external Origin headers; HTTP (non-HTTPS) WebSocket connections to the Jenkins controller from IP addresses not associated with known Jenkins clients.
• Logs: Jenkins access logs showing WebSocket CLI connections with Origin headers that do not match the configured Jenkins URL; repeated who-am-i or groovy/groovysh CLI command executions attributed to the anonymous user.
• Process: Unexpected child processes spawned by the Jenkins Java process (e.g., shell commands, network utilities) if Groovy script execution was achieved.
• Application: Jenkins audit logs recording CLI command executions by the anonymous user, especially Groovy scripting commands (Jenkins Advisory).

Jenkins has released fixed versions: Jenkins 2.555 (weekly) and Jenkins LTS 2.541.3, which compute the expected WebSocket origin using the configured Jenkins URL (from Manage Jenkins → System) rather than HTTP request headers, and refuse CLI WebSocket connections if the origin does not match or the Jenkins URL is not configured. As a workaround for administrators unable to upgrade, Jenkins recommends enabling authentication on the controller and removing all permissions from the anonymous user. If the fix causes issues, the previous behavior can be restored by setting the Java system property hudson.cli.CLIAction.ACCEPT_URL_FROM_REQUEST=true (not recommended for production). Additionally, ensuring Jenkins is served over HTTPS prevents DNS rebinding attacks entirely (Jenkins Advisory).

The vulnerability received coverage from multiple security news outlets including GBHackers, CyberPress, CyberSecurityNews, and The Hacker News (in a weekly recap), primarily in the context of a broader Jenkins security advisory that also included a high-severity symlink/tar extraction vulnerability (CVE-2026-33001). Security researchers and media framed the advisory as a significant risk to CI/CD pipeline security. The vulnerability was independently reported by two researchers (TallowX92 and Babauca), indicating active community engagement with Jenkins security. Red Hat also tracked the issue via Bugzilla, suggesting downstream impact assessment for RHEL-distributed Jenkins packages (Jenkins Advisory, Red Hat Bugzilla, GBHackers).