CVE-2026-84657: Jenkins CLI Auth Bypass Vulnerability

CVE-2026-84657 Overview

CVE-2026-84657 is a missing authorization vulnerability [CWE-862] in Jenkins that affects the build CLI command. In Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier, the command fails to check the Item/Cancel permission when the -s flag is used. The -s flag causes the CLI to wait for build completion, and cancelling that wait cancels the underlying build. Attackers with only Item/Build permission can therefore cancel builds started by other users, disrupting continuous integration pipelines.

Critical Impact
Users holding Item/Build permission can cancel in-progress builds triggered by other users, undermining build pipeline integrity and availability.

Affected Products

Jenkins weekly 2.579 and earlier
Jenkins LTS 2.568.2 and earlier
Jenkins build CLI command invoked with the -s flag

Discovery Timeline

2026-09-02 - CVE-2026-84657 published to NVD
2026-09-02 - Jenkins Security Advisory SECURITY-4015 released
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84657

Vulnerability Analysis

Jenkins exposes a command-line interface for triggering and monitoring builds. The build CLI command accepts a -s flag that instructs the client to wait synchronously until the triggered build finishes. When the CLI session is terminated while waiting, Jenkins interprets that as a cancellation request and cancels the underlying build.

The issue is a broken access control check. Jenkins verifies Item/Build when the command is initially issued, but does not re-check Item/Cancel before cancelling the build during the wait phase. This gap allows a user with permission to start builds to also cancel builds owned by others, even without cancellation rights.

Root Cause

The root cause is a missing authorization check [CWE-862] in the cancellation path of the build -s CLI workflow. The command implicitly cancels a build through session termination, but the code path that performs the cancellation does not enforce the Item/Cancel permission that the Jenkins UI and REST cancellation endpoints require.

Attack Vector

Exploitation requires authenticated network access to the Jenkins controller and Item/Build permission on a target job. An attacker invokes the build CLI command with the -s flag against a job another user has queued or is executing, then terminates the CLI session to trigger cancellation. Attack complexity is high because the attacker must time the cancellation while another user's build is in progress.

No verified public exploit code is available. See the Jenkins Security Advisory - 2026-09-02 for technical details.

Detection Methods for CVE-2026-84657

Indicators of Compromise

Jenkins audit log entries showing build CLI invocations with the -s flag terminating shortly after a build starts.
Builds moving to an aborted state where the cancelling user differs from the user who triggered the build.
Unusual spikes in aborted builds correlated with a single authenticated CLI client or IP address.

Detection Strategies

Enable and review Jenkins access and CLI logs to correlate build triggers, cancellations, and originating user accounts.
Deploy the Audit Trail plugin to record CLI command execution, target items, and authenticated principals.
Alert when a user without Item/Cancel permission is recorded as the actor cancelling a running build.

Monitoring Recommendations

Forward Jenkins controller logs to a centralized logging or SIEM platform for retention and correlation.
Track baselines of aborted-build rates per job and per user, and alert on statistically significant deviations.
Monitor authentication events for CLI clients and flag accounts producing repeated short-lived build -s sessions.

How to Mitigate CVE-2026-84657

Immediate Actions Required

Upgrade Jenkins weekly to 2.580 or later, or Jenkins LTS to 2.568.3 or later, according to the Jenkins Security Advisory.
Review role and permission assignments to ensure Item/Build is granted only to trusted users on shared jobs.
Audit recent build cancellation events to identify any abuse consistent with this weakness.

Patch Information

Jenkins addressed CVE-2026-84657 in the versions released with Security Advisory SECURITY-4015 on 2026-09-02. The fix adds an Item/Cancel permission check to the cancellation path invoked by the build CLI command when using the -s flag. Refer to the Jenkins Security Advisory - 2026-09-02 for the exact fixed versions and remediation notes.

Workarounds

Restrict Item/Build permission on sensitive jobs to users who are also authorized to cancel builds.
Disable or restrict CLI access on the Jenkins controller if the build -s workflow is not required.
Isolate the Jenkins controller behind network controls that limit CLI access to trusted administrative networks.

bash

# Verify the running Jenkins version before and after upgrade
curl -s -I https://jenkins.example.com/ | grep -i '^X-Jenkins:'

# Example: disable the CLI over remoting if not required (Jenkins system properties)
# Add to JENKINS_JAVA_OPTIONS and restart the controller
-Djenkins.CLI.disabled=true