A flaw in Jenkins’ CLI WebSocket endpoint allows an attacker to bypass origin validation using DNS rebinding. The server trusts the Host or X‑Forwarded‑Host headers to compute an expected origin, but the calculation can be subverted by an attacker who controls the domain name used in the WebSocket request. Successful exploitation permits an attacker to run arbitrary commands on the Jenkins controller, exposing the system to complete takeover.

Jenkins Project releases from 2.442 through 2.554 and LTS releases from 2.426.3 through 2.541.2 are vulnerable. All installers and Docker images built from these version ranges are affected. The vulnerability does not impact earlier or newer releases outside these ranges.

The CVSS score of 7.5 indicates high severity, while an EPSS score of less than 1% suggests that widespread exploitation is currently uncommon. As the flaw relies on a standard DNS rebinding technique, an attacker only needs control of a domain to target a Jenkins instance that accepts CLI WebSocket requests. The vulnerability remains unlisted in the CISA KEV catalog, but the potential for remote code execution warrants immediate attention.