CVE-2026-84660: Jenkins/Jenkins Pipeline: Build Step Plugin vulnerability
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
Affected Software
Event History
Frequently Asked Questions
Who is affected by this issue?
Jenkins instances using Pipeline: Build Step Plugin version 599.v4b_67ea_11b_152 or earlier are affected when Pipeline jobs use the build step to trigger downstream builds.
What permissions does an attacker need to exploit this?
The relevant authentication must be able to trigger a downstream build through the build step. The issue allows that downstream build to be canceled even if that authentication does not have Item/Cancel permission on the downstream job.
What is the impact of exploitation?
An unauthorized user or process can cause downstream builds triggered by the build step to be canceled. This can disrupt job execution despite the absence of Item/Cancel permission on the affected downstream job.