CVE-2026-84660 Overview
CVE-2026-84660 is a missing authorization vulnerability [CWE-862] in the Jenkins Pipeline: Build Step Plugin. Versions 599.v4b_67ea_11b_152 and earlier fail to verify permissions when the build step cancels downstream builds. As a result, downstream builds get canceled even when the triggering build's authentication lacks the Item/Cancel permission on the downstream job. An attacker with limited Jenkins access can disrupt continuous integration workflows by canceling jobs they should not control.
Critical Impact
Users with restricted Jenkins permissions can cancel downstream builds without holding Item/Cancel authorization, enabling integrity and availability impact against CI/CD pipelines.
Affected Products
- Jenkins Pipeline: Build Step Plugin version 599.v4b_67ea_11b_152
- Jenkins Pipeline: Build Step Plugin earlier versions
- Jenkins controllers running the vulnerable plugin
Discovery Timeline
- 2026-09-02 - Jenkins publishes Security Advisory SECURITY-3870
- 2026-09-02 - CVE-2026-84660 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84660
Vulnerability Analysis
The Jenkins Pipeline: Build Step Plugin exposes the build step within Pipeline scripts to trigger downstream jobs. When a pipeline invokes build and later cancels the downstream job, the plugin does not confirm that the pipeline's authentication holds Item/Cancel permission on the target job. The cancel action proceeds regardless.
This is a broken access control issue mapped to CWE-862 (Missing Authorization). Jenkins normally enforces per-item permissions such as Item/Read, Item/Build, and Item/Cancel through its authorization strategy. This plugin bypasses that check for the cancellation path, breaking the least-privilege model expected across multi-team Jenkins deployments.
The impact is limited to integrity and availability. No confidential data is disclosed, but attackers can interrupt release pipelines, block automated tests, and delay production deployments.
Root Cause
The plugin performs the cancel operation using elevated context rather than the pipeline job's own authentication. The permission check for Item/Cancel on the downstream project is missing from the code path that terminates in-progress downstream builds triggered by the build step.
Attack Vector
An attacker requires an authenticated Jenkins account with permission to configure or run a pipeline job. The attacker authors a pipeline that calls the build step against a sensitive downstream job and then cancels it, either directly or by triggering an abort condition in the parent pipeline. Because the plugin skips the Item/Cancel check, the downstream build stops even when the pipeline identity lacks that permission on the target job. See the Jenkins Security Advisory 2026-09-02 for full technical details.
Detection Methods for CVE-2026-84660
Indicators of Compromise
- Downstream build cancellations recorded in builds/*/log where the initiating user or pipeline identity does not hold Item/Cancel on the target job.
- Repeated build step invocations from pipelines followed by immediate downstream aborts across unrelated projects.
- Audit log entries showing job cancellations attributed to system context rather than an authorized user.
Detection Strategies
- Inventory Jenkins controllers and enumerate installed versions of the Pipeline: Build Step Plugin; flag any at 599.v4b_67ea_11b_152 or earlier.
- Correlate Jenkins audit logs with the authorization matrix to identify cancellations that violate configured permissions.
- Review pipeline scripts in source control for build step usage that targets jobs owned by other teams.
Monitoring Recommendations
- Forward Jenkins system and audit logs to a centralized SIEM and alert on unexpected Executor#interrupt or job abort events.
- Track baseline cancellation rates per job and alert on statistical anomalies that may indicate abuse.
- Monitor plugin update activity on Jenkins controllers to confirm remediation across the estate.
How to Mitigate CVE-2026-84660
Immediate Actions Required
- Upgrade the Jenkins Pipeline: Build Step Plugin to a version later than 599.v4b_67ea_11b_152 as published in the Jenkins security advisory.
- Audit user and group permissions on sensitive jobs and remove unnecessary Pipeline authoring or execution rights.
- Review recent build cancellations to identify potential prior abuse of this weakness.
Patch Information
Refer to the Jenkins Security Advisory 2026-09-02 (SECURITY-3870) for the fixed plugin version and upgrade instructions. Apply the patched release through the Jenkins Update Center or by installing the updated plugin .hpi file directly on affected controllers.
Workarounds
- Restrict Pipeline job creation and configuration to trusted users until the plugin is upgraded.
- Segment sensitive downstream jobs onto separate Jenkins controllers to limit cross-team build step exposure.
- Disable or remove Pipeline scripts that call the build step against jobs outside the caller's authorization scope.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
