CVE-2026-84661
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
Risk Assessment
An attacker with permissions to trigger builds can cancel downstream builds they are not authorized to cancel, potentially disrupting CI/CD processes and causing damage.
Recommendation
Update the Pipeline: Build Step plugin to a version that fixes the missing permission check. Review and restrict permissions to trigger builds.
Other vulnerabilities in Jenkins Pipeline: Build Step Plugin
Original NVD description (English source)
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS