New Critical Jenkins Vulnerabilities Put CI/CD Servers at Risk of RCE Exploits

Jenkins published a critical advisory describing multiple vulnerabilities in the core server and the LoadNinja plugin that can lead to arbitrary file creation, credential exposure, and remote code execution—most notably a symlink-based archive extraction flaw (CVE-2026-33001) and a DNS rebinding bypass of CLI WebSocket origin checks (CVE-2026-33002). Administrators are advised to upgrade to Jenkins weekly 2.555 or LTS 2.541.3 and LoadNinja 2.2, enforce authentication, revoke anonymous permissions, and require HTTPS to mitigate exploitation.