Jenkins Pipeline Build Step Plugin CVEs and Security Vulnerabilities

CVE-2026-84660

Missing Permission Check Enables Unauthorized Build Cancellation in Jenkins Pipeline Build Step Plugin

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins Pipeline Build Step Plugin

CVE-2026-84661

Missing Permission Check Allows Unauthorized Cancellation of Downstream Builds in Jenkins Pipeline Build Step Plugin

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.