Critical Jenkins Vulnerabilities Expose CI/CD Servers to RCE Attacks

### Jenkins vulnerabilities expose CI/CD servers (Advisory, 2026-03-18) A security advisory describes multiple high-severity vulnerabilities in Jenkins core—most notably CVE-2026-33001 (symlink handling during .tar/.tar.gz extraction leading to arbitrary file writes and potential full remote code execution on the controller) and CVE-2026-33002 (DNS rebinding bypass of WebSocket CLI origin validation enabling unauthorized CLI/Groovy execution under certain configurations)—plus medium-severity LoadNinja plugin issues (CVE-2026-33003/33004) that store and display API keys insecurely; the advisory urges upgrading Jenkins to 2.555 (weekly) or 2.541.3 (LTS), updating the plugin to v2.2, and applying mitigations such as disabling anonymous access and enforcing strict authentication.