Critical Jenkins Flaws Expose CI/CD Servers to RCE Attacks

Key Takeaways

• Multiple critical vulnerabilities have been discovered in Jenkins core and the LoadNinja plugin.
• The most severe flaw, CVE-2026-33001, allows remote code execution (RCE) via crafted archive extraction, impacting CI/CD pipelines.
• Another high-severity issue, CVE-2026-33002, involves a DNS rebinding vulnerability in WebSocket CLI origin validation, potentially leading to RCE.
• A medium-severity flaw in the LoadNinja plugin (CVE-2026-33003, CVE-2026-33004) exposes unencrypted API keys.
• Patches are available, requiring upgrades to Jenkins 2.555 (weekly) or 2.541.3 (LTS) and LoadNinja plugin v2.2.

A recent security bulletin has brought to light several significant vulnerabilities affecting Jenkins, the widely used open-source automation server, and one of its plugins. These flaws, identified on March 18, 2026, range from critical to medium severity and could enable attackers to achieve remote code execution (RCE) and compromise continuous integration/continuous deployment (CI/CD) environments.

Critical Archive Extraction Flaw Leads to RCE

The most pressing vulnerability, designated CVE-2026-33001, resides in Jenkins’ handling of symbolic links during the extraction of .tar and .tar.gz archives. This flaw allows authenticated attackers with item configuration permissions to craft malicious archives. When these archives are processed, the vulnerability permits the writing of files to arbitrary locations on the Jenkins controller’s file system.

Exploiting this, threat actors could inject malicious scripts into the init.groovy.d/ directory or deploy rogue plugins directly into the plugins/ folder. Such actions would grant them full remote code execution capabilities. Features like the “Archive the artifacts” post-build action and specific pipeline steps are particularly susceptible to this vulnerability due to their reliance on the vulnerable archive extraction functionality.

WebSocket Hijacking via DNS Rebinding

Another high-severity vulnerability, CVE-2026-33002, involves a DNS rebinding flaw impacting the WebSocket command-line interface (CLI) origin validation. Jenkins computes expected origins based on HTTP request headers. Attackers can bypass this validation by luring a victim to a malicious website that resolves to the Jenkins controller’s IP address. This maneuver establishes an unauthorized WebSocket connection to the CLI endpoint.

If the Jenkins environment is configured to permit anonymous user permissions and operates over unencrypted HTTP, attackers can then execute arbitrary CLI commands. The extent of the compromise, including the potential for Groovy scripting execution and subsequent remote code execution, depends directly on the access level granted to anonymous users.

LoadNinja Plugin Exposes API Keys

Beyond the core Jenkins vulnerabilities, the advisory also highlighted a medium-severity issue within the LoadNinja Plugin. Tracked under two CVEs—CVE-2026-33003 for insecure storage and CVE-2026-33004 for a lack of masking—this plugin was found to store API keys in an unencrypted format within job configuration files. Furthermore, its configuration interface failed to mask these sensitive credentials, leaving them visible to any user possessing extended read permissions or direct file system access.

According to the Jenkins Project security advisory, immediate action is required. Administrators must upgrade their Jenkins installations to version 2.555 (weekly release) or 2.541.3 (LTS release). Additionally, users of the LoadNinja plugin should update to version 2.2.

What You Should Do

• Apply Patches Immediately: Upgrade your Jenkins controller to version 2.555 (weekly) or 2.541.3 (LTS) without delay.
• Update LoadNinja Plugin: If you use the LoadNinja plugin, ensure it is updated to version 2.2 to address the API key exposure.
• Strengthen Authentication: For the DNS rebinding flaw, configure strict authentication requirements for your Jenkins controller.
• Revoke Anonymous Permissions: Completely remove or severely restrict permissions for the anonymous user account within your Jenkins environment.
• Review Access Controls: Regularly audit and minimize user permissions, especially those with item configuration or extended read access.
• Encrypt Sensitive Data: Implement best practices for storing all sensitive credentials and API keys in encrypted formats, utilizing secure credential management systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.