CVE-2026-33002: Jenkins Auth Bypass Vulnerability

CVE-2026-33002 Overview

CVE-2026-33002 is a DNS rebinding vulnerability affecting Jenkins automation servers. The vulnerability exists in how Jenkins validates the origin of requests made through the CLI WebSocket endpoint. By computing the expected origin using the Host or X-Forwarded-Host HTTP request headers, an attacker can exploit DNS rebinding techniques to bypass origin validation controls, potentially gaining unauthorized access to Jenkins CI/CD infrastructure.

Critical Impact

Attackers can bypass origin validation through DNS rebinding attacks, potentially allowing unauthorized access to Jenkins CLI WebSocket functionality and enabling malicious actions against the Jenkins server.

Affected Products

• Jenkins 2.442 through 2.554 (both inclusive)
• Jenkins LTS 2.426.3 through LTS 2.541.2 (both inclusive)

Discovery Timeline

• 2026-03-18 - CVE-2026-33002 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-33002

Vulnerability Analysis

This vulnerability stems from improper origin validation in Jenkins' CLI WebSocket endpoint implementation. The flaw is classified under CWE-350 (Reliance on Reverse DNS Resolution for a Security-Critical Action), which describes scenarios where security controls depend on DNS-based information that can be manipulated by attackers.

When Jenkins processes WebSocket connections through its CLI interface, it validates the origin of incoming requests by computing an expected origin value. However, this computation relies on the Host or X-Forwarded-Host HTTP headers provided in the request. Since DNS rebinding attacks allow an attacker to control DNS resolution and manipulate these header values, the origin validation can be bypassed entirely.

Exploitation requires user interaction, as the victim must visit a malicious website controlled by the attacker that initiates the DNS rebinding attack. Once successful, the attacker can issue CLI commands to the Jenkins server as if the requests originated from a trusted source.

Root Cause

The root cause of CVE-2026-33002 lies in Jenkins' reliance on client-supplied HTTP headers (Host and X-Forwarded-Host) for security-critical origin validation. These headers can be manipulated through DNS rebinding techniques where:

1. The attacker controls a domain with a low TTL DNS record
2. The victim visits the attacker's site, which initially resolves to the attacker's server
3. The DNS record is then changed to point to the target Jenkins server
4. Subsequent requests from the victim's browser are sent to Jenkins with attacker-controlled origin headers

This architectural weakness allows requests that should be rejected by origin validation to pass through, undermining the security boundary intended to protect the WebSocket CLI endpoint.

Attack Vector

The attack is network-based and requires user interaction. An attacker must:

1. Set up a malicious website with controlled DNS resolution
2. Configure a short TTL on their DNS records
3. Lure a victim with Jenkins access to visit the malicious site
4. Execute the DNS rebinding attack to redirect browser requests to the target Jenkins server
5. Leverage the bypassed origin validation to execute CLI commands through the WebSocket endpoint

The vulnerability allows exploitation without authentication, though the attacker depends on the victim's existing session or access privileges to Jenkins. The attack affects confidentiality, integrity, and availability of the Jenkins server once successful.

Detection Methods for CVE-2026-33002

Indicators of Compromise

• Unusual WebSocket connections to the Jenkins CLI endpoint from unexpected origins
• DNS resolution anomalies where client IP addresses resolve to external domains with rapidly changing DNS records
• Unexpected CLI commands executed through WebSocket connections correlating with user browser activity

Detection Strategies

• Monitor Jenkins access logs for CLI WebSocket endpoint requests with suspicious Host or X-Forwarded-Host headers
• Implement network monitoring to detect DNS rebinding patterns, particularly domains with abnormally low TTL values
• Deploy browser security controls that restrict cross-origin WebSocket connections

Monitoring Recommendations

• Enable detailed logging for Jenkins CLI WebSocket endpoint activity
• Set up alerts for origin validation failures or unusual origin patterns in request headers
• Monitor for rapid DNS resolution changes from client systems accessing Jenkins

How to Mitigate CVE-2026-33002

Immediate Actions Required

• Upgrade Jenkins to a version beyond 2.554 (weekly) or beyond LTS 2.541.2 that addresses this vulnerability
• Review and restrict network access to Jenkins servers to trusted networks only
• Consider disabling the CLI WebSocket endpoint if not required for operations

Patch Information

Jenkins has released a security advisory addressing this vulnerability. Administrators should upgrade to the latest patched versions as outlined in the Jenkins Security Advisory #SECURITY-3674. The patch implements proper origin validation that does not rely solely on client-supplied headers.

Workarounds

• Place Jenkins behind a reverse proxy that enforces strict origin validation independent of client headers
• Restrict access to the Jenkins CLI WebSocket endpoint using network-level controls
• Implement additional authentication requirements for CLI WebSocket connections
• Configure browser security policies to limit cross-origin WebSocket connections to Jenkins

# Example: Restrict Jenkins CLI access via iptables
# Only allow CLI WebSocket connections from trusted internal networks
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP