CVE-2026-84661: Jenkins Jenkins Pipeline: Build Step Plugin vulnerability
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Jenkins user or build whose authentication can use the `waitForBuild` Pipeline step with the `propagateAbort` parameter may be able to cancel a downstream build without having Item/Cancel permission on that downstream job.
What condition is required for the unauthorized cancellation to occur?
The downstream build must be awaited through the `waitForBuild` step, and the step must use the `propagateAbort` parameter. The issue concerns cancellation of that downstream build when the waiting build is aborted.
How can I determine whether an instance is affected?
Check the installed Jenkins Pipeline: Build Step Plugin version. Versions 599.v4b_67ea_11b_152 and earlier are affected.