Jenkins CVE-2026-53438

The attacker must be authenticated to the Jenkins instance (CVSS PR:L confirms low-privilege authentication is required - unauthenticated exploitation is not possible). The specific exploitable condition is holding Item/Cancel permission on a queue item while lacking Item/Read permission on that same item - a permission split that arises in deployments using fine-grained or role-based access control with separated duties. Default Jenkins installations with standard role assignments are unlikely to exhibit this split, limiting exposure primarily to multi-tenant or enterprise Jenkins environments with customized permission matrices. Exploitation is further bounded by impact: only queue item cancellation is possible; no data is readable and no code executes. The attacker must also know or enumerate a valid queue item ID for the target project.

CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates a network-reachable, low-complexity attack requiring low-privilege authentication, with impact confined to integrity (canceling queue items) and no confidentiality or availability impact. Real-world risk is moderate-to-low: exploitation requires a valid Jenkins account with a specific, non-default permission combination (Item/Cancel without Item/Read), which is most likely to exist in organizations using fine-grained RBAC across multiple teams or projects. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The absence from CISA KEV and the lack of reported POC code further support a low exploitation urgency. This is not a critical incident response scenario but should be patched in the normal patch cycle, particularly for organizations running multi-tenant Jenkins with custom permission matrices.

An attacker with a low-privilege Jenkins account that holds Item/Cancel but not Item/Read on a target project authenticates to the Jenkins instance and submits a cancel request referencing a queue item ID for a pipeline they cannot view. Because the missing permission check allows the cancel action to proceed without verifying Item/Read, the targeted build is aborted, potentially disrupting another team's CI/CD workflow or delaying a release pipeline. No public exploit code is required - the attack is straightforward HTTP request manipulation against the Jenkins queue API.