Jenkins CVE-2026-84657

Exploitation requires an authenticated Jenkins account with Item/Build permission on the targeted job - unauthenticated exploitation is not possible (PR:L in CVSS). The attacker must use the Jenkins CLI (build command with the -s flag) while a build started by another user is actively running. The attack is not exploitable if: the Jenkins CLI is disabled (jenkins.CLI.disabled=true), if Item/Build is restricted to fully trusted personnel, if only a single user triggers builds on shared jobs, or if all Item/Build holders are also explicitly granted Item/Cancel (removing any meaningful privilege delta). The high attack complexity (AC:H) reflects the timing requirement - the target build must be in-flight.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L, score 4.2) is well-calibrated. AC:H reflects the timing-dependent exploitation condition: a build started by another user must be actively running and the attacker must invoke the CLI with -s against it. PR:L correctly captures the requirement for a valid Jenkins account with at least Item/Build permission - unauthenticated exploitation is not possible. Impact is bounded: no confidentiality exposure, limited integrity disruption (unauthorized cancellation), and limited availability disruption (pipeline interruption). EPSS data is not present in the input, but given the low CVSS score, targeted nature, and absence from KEV, real-world exploitation priority is low. The primary risk is insider-threat or multi-tenant Jenkins scenarios where users compete for build slots or seek to sabotage peers' pipelines. Generic single-user or tightly access-controlled instances are not meaningfully affected.

An authenticated Jenkins user (e.g., a developer with Item/Build access but not Item/Cancel) opens the Jenkins CLI and runs java -jar jenkins-cli.jar -s http://jenkins.internal/ build target-job -s to attach to a build that a different user just triggered. Because the cancel path bypasses the Item/Cancel check, the attacker's disconnect or explicit cancel terminates the victim user's build. No public proof-of-concept code has been identified, but exploitation requires only standard Jenkins CLI tooling.