CVE-2026-53438: Medium severity Jenkins Jenkins vulnerability
A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Revoke Item/Cancel from any user or role that does not also have Item/Read. Configure your authorization strategy (e.g., Role-Based Strategy plugin or matrix-based security) so that Item/Cancel is only assignable together with Item/Read or is restricted to trusted administrator roles.
Jenkins Item/Cancel permission assignment = grant only to users/groups that also have Item/Read - Compensating control
Enforce least-privilege for Jenkins management: limit assignment of Item/Cancel to a small set of trusted accounts and restrict access to the Jenkins UI and management endpoints to trusted IPs or networks via firewall, VPN, or reverse-proxy access controls.
- Operational
Audit current permission assignments to find users/roles with Item/Cancel but without Item/Read, remove inappropriate assignments, and review Jenkins audit logs for recent unauthorized queue cancellations. Restore any impacted queued jobs/configuration as needed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53438?
CVE-2026-53438 has a medium severity rating of 4.3.
How do I fix CVE-2026-53438?
To remediate CVE-2026-53438, upgrade Jenkins to version 2.568 or later or LTS 2.555.3 or later.
What are the potential impacts of exploiting CVE-2026-53438?
Exploiting CVE-2026-53438 allows unauthorized users to cancel queue items they cannot view.
In which versions of Jenkins is CVE-2026-53438 present?
CVE-2026-53438 affects Jenkins versions 2.567 and earlier and LTS versions 2.555.2 and earlier.
Who is affected by CVE-2026-53438?
Users with Item/Cancel permission but lacking Item/Read permission are affected by CVE-2026-53438.