CVE-2026-84657: Jenkins Jenkins vulnerability
Published Sep 2, 2026
·Updated
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users.
Affected Software
2 affected components
Jenkins Jenkins<=2.579
Jenkins Jenkins LTS<=2.568.2
Event History
Sep 2, 2026
CVE Published
via MITRE·03:40 PM
Data Sourced
via MITRE·03:40 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
A user with Item/Build permission can exploit it. The issue lets that user cancel a build started by another user when using the build CLI command with the -s flag.
2
Is Item/Cancel permission required to cancel another user's build through the affected path?
No. In the affected build CLI -s workflow, Jenkins does not check Item/Cancel permission before cancellation.
3
Which deployments are affected?
Jenkins 2.579 and earlier, and Jenkins LTS 2.568.2 and earlier, are affected.