New Critical Jenkins Vulnerabilities Put CI/CD Servers at Risk of RCE Exploits

Security Advisory for Jenkins Core and LoadNinja Plugin

The Jenkins project has issued a critical security advisory addressing several vulnerabilities in its core automation server and the LoadNinja plugin. These vulnerabilities pose significant risks to continuous integration and continuous deployment (CI/CD) environments, including arbitrary file creation, credential exposure, and remote code execution (RCE). Given the elevated privileges Jenkins controllers often possess across enterprise networks, it is crucial for administrators to apply patches promptly to protect their build pipelines from potential exploitation.

Archive Extraction and Symbolic Link Vulnerability

Among the identified issues, CVE-2026-33001 is a high-severity vulnerability affecting Jenkins core versions 2.554 and LTS 2.541.2 and earlier. This vulnerability involves arbitrary file creation due to improper handling of symbolic links when extracting .tar and .tar.gz archives. Attackers can exploit this to create files in arbitrary locations on the controller’s filesystem, limited only by the operating system file permissions of the Jenkins service user.

Attackers with configuration or agent control permissions could exploit features such as the "Archive the artifacts" post-build action to write malicious Groovy scripts to JENKINS_HOME/init.groovy.d/ or deploy unauthorized tools to JENKINS_HOME/plugins/ . This could lead to full remote code execution upon service restart or file processing.

CVE-2026-33002 is another high-severity vulnerability related to DNS rebinding, which bypasses origin validation in the Jenkins command-line interface (CLI) WebSocket endpoint. This vulnerability can be exploited by tricking a user into visiting a malicious website that uses DNS rebinding to access the Jenkins controller’s internal IP address, potentially allowing execution of administrative CLI commands.

If the Jenkins instance allows access over plain HTTP and anonymous users have elevated permissions, attackers could use Groovy scripting capabilities to achieve arbitrary code execution, compromising the server entirely.

The LoadNinja plugin has two medium-severity vulnerabilities, CVE-2026-33003 and CVE-2026-33004, affecting versions 2.1 and earlier. These versions store API keys unencrypted in the job config.xml files and fail to mask these keys in the job configuration interface, which could allow unauthorized users to access sensitive credentials.

Administrators should upgrade to Jenkins weekly version 2.555 or Jenkins LTS version 2.541.3 to address these vulnerabilities. The updates include improved path validation for archive extraction and strengthened CLI origin checks based on the configured Jenkins URL. Organizations using the LoadNinja plugin should update to version 2.2 to ensure proper encryption and masking of API keys.

If immediate updates are not feasible, it is advised to enforce authentication on all controllers, revoke permissions from anonymous users, and restrict access to Jenkins via HTTPS to reduce vulnerability exposure.

Based on reporting by GBHackers.