Jenkins Patches Critical Symlink and DNS Rebinding Flaws in March 2026 Advisory
Jenkins released a security advisory on March 18, 2026, fixing three vulnerabilities including a high-severity symlink bug that can lead to arbitrary code execution and a DNS rebinding flaw in the WebSocket CLI.
Jenkins released a security advisory on March 18, 2026, addressing three vulnerabilities in Jenkins Core and the LoadNinja plugin. The most critical flaws include a symlink following vulnerability (CVE-2026-33001) and a DNS rebinding vulnerability in the WebSocket CLI (CVE-2026-33002), both rated high severity. Users are urged to update to Jenkins 2.555 (weekly) or LTS 2.541.3, and LoadNinja Plugin 2.2, immediately.
The symlink vulnerability (CVE-2026-33001) affects Jenkins 2.554 and earlier, and LTS 2.541.2 and earlier. It arises from unsafe handling of symbolic links during extraction of .tar and .tar.gz archives. Attackers with Item/Configure permission or control over agent processes can craft archives that write files to arbitrary locations on the filesystem. By placing malicious scripts in the JENKINS_HOME/init.groovy.d/ directory or deploying rogue plugins to JENKINS_HOME/plugins/, an attacker can achieve arbitrary code execution on the controller. The fix in Jenkins 2.555 and LTS 2.541.3 refuses to extract files whose real path is outside the target directory and blocks extraction through symbolic links.
The DNS rebinding vulnerability (CVE-2026-33002) affects Jenkins 2.442 through 2.554 and LTS 2.426.3 through LTS 2.541.2. The WebSocket CLI endpoint, introduced in Jenkins 2.217, relies on origin validation to prevent cross-site WebSocket hijacking. However, the validation incorrectly uses the Host or X-Forwarded-Host headers to compute the expected origin. An attacker can use DNS rebinding to make a victim's browser resolve a malicious domain to the Jenkins controller's IP, then establish a WebSocket connection from an untrusted origin. If the anonymous user has permissions, the attacker can execute CLI commands, including Groovy scripting, leading to arbitrary code execution. The fix uses the configured Jenkins URL instead of HTTP headers for origin validation.
The LoadNinja Plugin (CVE-2026-33003, CVE-2026-33004) stores API keys unencrypted in job config.xml files, viewable by users with Item/Extended Read permission or filesystem access. The job configuration form also fails to mask the keys. LoadNinja Plugin 2.2 encrypts stored keys and masks them on the form, addressing both issues.
Jenkins administrators who cannot immediately update are advised to set up authentication, remove permissions from the anonymous user, and ensure Jenkins is accessed over HTTPS to mitigate the DNS rebinding flaw. The advisory credits Adam Jordan for reporting the LoadNinja issue and Nguyen Ngoc Quang Bach for the symlink and DNS rebinding vulnerabilities.