CVE-2026-27100: Infoleak
Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27100?
CVE-2026-27100 has a moderate severity level due to the potential exposure of sensitive information.
How do I fix CVE-2026-27100?
To fix CVE-2026-27100, upgrade to Jenkins 2.551 or later, or LTS 2.541.2 or later.
What versions of Jenkins are affected by CVE-2026-27100?
Jenkins versions up to 2.550 and LTS versions up to 2.541.1 are affected by CVE-2026-27100.
What risks are associated with CVE-2026-27100?
CVE-2026-27100 allows attackers to gain unauthorized access to information about jobs and builds they shouldn't be able to see.
Who is vulnerable to CVE-2026-27100?
Users of Jenkins with Item/Build and Item/Configure permissions may be vulnerable to CVE-2026-27100.