CVE-2026-84661: Jenkins Pipeline Build Step Plugin Escalation

CVE-2026-84661 Overview

CVE-2026-84661 is a missing authorization vulnerability [CWE-862] in the Jenkins Pipeline: Build Step Plugin. Versions 599.v4b_67ea_11b_152 and earlier fail to verify permissions when the waitForBuild step cancels downstream builds using the propagateAbort parameter. An attacker with limited Jenkins access can cancel downstream jobs even when the build's authentication lacks Item/Cancel permission on the target job. The issue affects continuous integration pipelines that rely on Jenkins for build orchestration and access control.

Critical Impact
Authenticated users can cancel downstream Jenkins builds without holding the required Item/Cancel permission, disrupting CI/CD pipelines and build integrity.

Affected Products

Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier
Jenkins controllers running vulnerable versions of the plugin
CI/CD pipelines using the waitForBuild step with propagateAbort

Discovery Timeline

2026-09-02 - Jenkins Security Advisory SECURITY-3870 published
2026-09-02 - CVE CVE-2026-84661 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84661

Vulnerability Analysis

The Pipeline: Build Step Plugin provides the waitForBuild step, which allows a pipeline to wait for a downstream build to complete. When callers pass propagateAbort: true, an abort in the upstream pipeline is propagated to the downstream build, causing that build to be canceled. The plugin issues the cancellation without verifying that the calling build's authentication holds the Item/Cancel permission on the downstream job.

This permission gap breaks the Jenkins authorization model, where each job cancellation should be governed by explicit access control. In hardened Jenkins deployments that separate build authentication using Authorize Project or similar strategies, the missing check bypasses those boundaries.

Root Cause

The root cause is a missing authorization check [CWE-862] in the code path that handles propagateAbort inside waitForBuild. The plugin acts on the abort signal directly instead of consulting Jenkins' permission subsystem for Item/Cancel on the downstream job. See the Jenkins Security Advisory #SECURITY-3870 for the maintainer's technical description.

Attack Vector

An attacker requires authenticated access to define or modify a Jenkins pipeline that invokes waitForBuild against a downstream job they cannot otherwise cancel. When the upstream job is aborted, the plugin propagates the cancellation to the downstream job, bypassing the permission check. Exploitation is network-reachable and requires only low privileges, with impact limited to integrity and availability of build jobs.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported.

Detection Methods for CVE-2026-84661

Indicators of Compromise

Downstream Jenkins builds canceled with status ABORTED where the initiating pipeline's authentication lacks Item/Cancel on the target job.
Unexpected hudson.model.Run$Summary cancellation events correlated with upstream pipelines using waitForBuild and propagateAbort: true.
Pipeline definitions authored by low-privilege users that reference downstream jobs outside their normal permission scope.

Detection Strategies

Audit Jenkins system and job logs for waitForBuild invocations combined with cancellation entries on downstream jobs.
Cross-reference the initiating user or build authentication against the target job's Item/Cancel permission matrix.
Inventory installed plugin versions using the Jenkins CLI or /pluginManager/api/json?depth=1 to identify hosts running pipeline-build-step at or below 599.v4b_67ea_11b_152.

Monitoring Recommendations

Forward Jenkins controller logs and audit trail data to a centralized SIEM for correlation of build cancellation events.
Alert on repeated downstream cancellations originating from a single upstream pipeline or user.
Track plugin update status across all Jenkins controllers to confirm patch adoption.

How to Mitigate CVE-2026-84661

Immediate Actions Required

Upgrade the Jenkins Pipeline: Build Step Plugin to a version later than 599.v4b_67ea_11b_152 as soon as the fixed release is available from the Jenkins update center.
Review existing pipelines for use of waitForBuild with propagateAbort: true and validate that intended cancellation behavior aligns with job permissions.
Restrict pipeline authoring permissions to trusted users while patching is in progress.

Patch Information

Refer to the Jenkins Security Advisory #SECURITY-3870 for the fixed plugin version and upgrade instructions. Jenkins recommends updating through the built-in plugin manager.

Workarounds

Avoid using the propagateAbort parameter on waitForBuild until the plugin is upgraded.
Configure the Authorize Project plugin so that builds run with authentication that legitimately holds Item/Cancel on downstream jobs, reducing scope for unauthorized cancellation.
Segregate sensitive downstream jobs onto separate Jenkins controllers with stricter access control until the fix is deployed.

bash

# Query installed plugin version from a Jenkins controller
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="pipeline-build-step") | {shortName, version, enabled}'