Jenkins Build Step Plugin CVE-2026-84661

Exploitation requires: (1) the attacker is authenticated to Jenkins with at least Job/Build (or equivalent) permission on an upstream pipeline job - no unauthenticated path exists; (2) the upstream pipeline uses the waitForBuild step with the propagateAbort parameter set to true - pipelines that do not use this parameter or set propagateAbort: false are unaffected; (3) a downstream build is actively awaited by that step at the time the upstream pipeline is aborted. Exploitation is limited to cancellation of downstream builds only - there is no code execution, data disclosure, or lateral escalation beyond the unauthorized cancel action. Environments where all users have Item/Cancel on all jobs (flat RBAC) are not meaningfully impacted.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L (5.4 Medium) accurately reflects the attack surface: network-reachable, no special conditions, but requires at least low-level authentication. The real-world impact is bounded - an attacker can cancel downstream builds they should not be able to, disrupting pipelines and availability of downstream jobs, but cannot read secrets or execute arbitrary code. In environments where Jenkins pipelines are gated by strict Item/Cancel ACLs (e.g., production release pipelines that non-release engineers should not be able to abort), this is a meaningful integrity and availability concern. There is no KEV listing and no POC was identified in the input, so opportunistic mass exploitation is unlikely. The primary risk is insider or low-privilege lateral action within a shared Jenkins environment where build isolation and RBAC matter.

An authenticated Jenkins user with low-privilege access (e.g., a developer with Build/Run permission on an upstream pipeline) configures a pipeline that calls waitForBuild with propagateAbort: true pointing at a protected production release job. When the upstream pipeline is aborted - either by the attacker or legitimately - the plugin propagates the cancel signal to the downstream release build without verifying Item/Cancel on that job, aborting a build the user could not directly cancel. No public exploit code has been identified at time of analysis.