Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding attacks that allow bypassing origin validation.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 970fd0ec-26f5-11f1-a9b1-0cc47ada5f32 advisory.

    Jenkins Security Advisory 2026-03-18:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs
    origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for
    comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding
    attacks that allow bypassing origin validation. (CVE-2026-33002)

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.541.3 or Jenkins weekly prior to 2.555. It is, therefore, affected by multiple vulnerabilities:

  - Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs     origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for     comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable to DNS rebinding     attacks that allow bypassing origin validation. (CVE-2026-33002)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
304042	FreeBSD : jenkins -- multiple vulnerabilities (970fd0ec-26f5-11f1-a9b1-0cc47ada5f32)	Nessus	FreeBSD Local Security Checks	Local	high
439006	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-phhv-63fh-rrc8)	Tenable Cloud Security	SCA Checks	Local	high
439006	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-phhv-63fh-rrc8)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
302902	Jenkins LTS < 2.541.3 / Jenkins weekly < 2.555 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2026-33002

high

Tenable Plugins

high

high

high

high