What is the CVSS score of CVE-2026-53438?

CVE-2026-53438 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Jenkins CVE-2026-53438

EUVD-2026-36022 MEDIUM

Missing Authorization (CWE-862)

2026-06-10 jenkins

GHSA-mw82-xcg6-gx79

Authentication Bypass Jenkins Red Hat

4.3

CVSS 3.1 · Vendor: jenkins

Severity by source

Vendor (jenkins) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (jenkins).

CVSS VectorVendor: jenkins

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 16:45 vuln.today

CVSS changed

Jun 10, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 10, 2026 - 13:05 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view.

AnalysisAI

Missing authorization enforcement in Jenkins allows low-privileged authenticated users to cancel build queue items they lack permission to view. Affecting Jenkins 2.567 and earlier (LTS 2.555.2 and earlier), this CWE-862 flaw breaks the expected access control invariant that Item/Cancel should be constrained by Item/Read visibility. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity and network accessibility make it a realistic threat in multi-tenant Jenkins deployments where fine-grained RBAC is in use.

Technical ContextAI

Jenkins implements a granular permission model that separates actions such as Item/Read (visibility), Item/Cancel (queue cancellation), and others. The root cause is CWE-862 (Missing Authorization): the server-side handler for queue cancellation operations fails to verify that the requesting user also holds Item/Read on the target item before executing the cancel action. This means the permission boundary between visibility and action is not enforced at the API level. The affected codebase is identified via CPE cpe:2.3:a:jenkins_project:jenkins:*:*:*:*:*:*:*:*, spanning all Jenkins (jenkins_project) releases up to and including the stated version thresholds.

RemediationAI

Upgrade to Jenkins 2.568 (weekly release) or Jenkins LTS 2.555.3, as confirmed by EUVD-2026-36022 and the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3712. If immediate patching is not feasible, the most targeted compensating control is to audit and tighten permission assignments: ensure that any role or user granted Item/Cancel permission is also explicitly granted Item/Read on the same scope, eliminating the exploitable permission gap. Alternatively, restrict Item/Cancel to only fully trusted roles. Revoking Item/Cancel from low-trust accounts entirely would prevent the bypass but may disrupt legitimate self-service cancellation workflows. The oss-security disclosure is available at https://seclists.org/oss-sec/2026/q2/867 for additional context.