CVE-2026-84660
published 2026-09-02CVE-2026-84660: A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be…
PriorityP431medium5.4CVSS 3.1
AVNACLPRLUINSUCNILAL
EPSS
0.36%
28.7th percentile
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | allure | — | — |
| jenkins | allure_plugin | — | — |
| jenkins | build_step | — | — |
| jenkins | build_step_plugin | — | — |
| jenkins | customizable_header | — | — |
| jenkins | customizable_header_plugin | — | — |
| jenkins | databoundsetter_annotated_methods_that_manage_the | — | — |
| jenkins | databoundsetter_annotated_methods_that_manage_the_plugin | — | — |
| jenkins | file_parameter | — | — |
| jenkins | file_parameter_plugin | — | — |
| jenkins | gitlab | — | — |
| jenkins | gitlab_plugin | — | — |
| jenkins | groovy_libraries | — | — |
| jenkins | groovy_libraries_plugin | — | — |
| jenkins | ids_in_xebialabs_xl_deploy | — | — |
| jenkins | ids_in_xebialabs_xl_deploy_plugin | — | — |
| jenkins | improper_access_control_in_customizable_header | — | — |
| jenkins | improper_access_control_in_customizable_header_plugin | — | — |
| jenkins | improper_access_control_in_ldap | — | — |
| jenkins | improper_access_control_in_ldap_plugin | — | — |
| jenkins | improper_access_control_in_saml | — | — |
| jenkins | improper_access_control_in_saml_plugin | — | — |
| jenkins | improper_access_control_in_thinbackup | — | — |
| jenkins | improper_access_control_in_thinbackup_plugin | — | — |
| jenkins | jenkins_core | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentic
ghsa_unreviewed·2026-09-02
CVE-2026-84660 [MEDIUM] CWE-862 A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentic
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
VulDB
Jenkins Project Build Step Plugin up to 599.v4b_67ea_11b_152 Permission Check build permission
vuldb·2026-09-02·CVSS 5.4
CVE-2026-84660 [MEDIUM] Jenkins Project Build Step Plugin up to 599.v4b_67ea_11b_152 Permission Check build permission
A vulnerability described as critical has been identified in Jenkins Project Build Step Plugin up to 599.v4b_67ea_11b_152. This vulnerability affects the function build of the component Permission Check. The manipulation results in permission issues.
This vulnerability is cataloged as CVE-2026-84660. The attack may be launched remotely. There is no exploit available.
Jenkins
Jenkins Security Advisory 2026-09-02
vendor_jenkins·2026-09-02·CVSS 8.8
CVE-2026-84645 [HIGH] Jenkins Security Advisory 2026-09-02
Title: Jenkins Security Advisory 2026-09-02
Jenkins Security Advisory 2026-09-02
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Allure
Plugin
Customizable Header
Plugin
File Parameter
Plugin
GitLab
Plugin
Job Configuration History
Plugin
LDAP
Plugin
Microsoft Entra ID (previ
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-02
Published