EUVD-2026-70126
GHSA-6c8f-jr82-2h3f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
PR:L reflects required authenticated access; I:L and A:L capture unauthorized build cancellation impact with no confidentiality exposure.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
5DescriptionCVE.org
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
AnalysisAI
Missing Item/Cancel permission enforcement in Jenkins Pipeline: Build Step Plugin ≤599.v4b_67ea_11b_152 allows authenticated low-privilege users to cancel downstream builds they are not authorized to abort. When an upstream pipeline job using the build step is canceled, the plugin propagates the cancellation to all triggered downstream jobs without verifying that the build's authentication context holds Item/Cancel permission on those downstream jobs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Jenkins session with at minimum Item/Build permission on an upstream pipeline job that contains a `build` step invoking a downstream job. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reflects a bounded but genuine impact: exploitation demands authenticated access, and consequences are limited to unauthorized build cancellations rather than data exfiltration or remote code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Jenkins Pipeline: Build Step Plugin to a version beyond 599.v4b_67ea_11b_152 per the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3870; confirm the specific patched release version in the Jenkins Update Center before deploying, as the exact fixed version number is not stated in the available advisory data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jenkins Pipeline
View allUnauthorized build cancellation in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier allows any authe
Cross-site request forgery in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows unauthentic
The Pipeline Snippet Generator in Jenkins Pipeline: Groovy Plugin versions through 4331.v9d06ed4658ff fails to enforce t
Cross-site request forgery in the Jenkins Pipeline: Groovy Plugin (versions up to and including 4331.v9d06ed4658ff) enab
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today