CVE-2026-84672: Jenkins Entra ID Auth Bypass Vulnerability

CVE-2026-84672 Overview

CVE-2026-84672 affects the Jenkins Microsoft Entra ID (previously Azure AD) Plugin version 710.v0b_ff8e9cc2d2 and earlier. The plugin grants Entra group permissions using both the group's unique object ID and its display name. Attackers who can create an Entra group with a colliding display name gain the permissions configured for a privileged group. This is an authorization bypass classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
An authenticated attacker with the ability to create Entra groups can escalate privileges by creating a group whose display name matches a privileged Jenkins group, inheriting its permissions.

Affected Products

Jenkins Microsoft Entra ID Plugin 710.v0b_ff8e9cc2d2 and earlier
Jenkins deployments using Entra ID authentication for authorization
Environments where users can create Entra ID groups

Discovery Timeline

2026-09-02 - CVE-2026-84672 published to NVD
2026-09-02 - Jenkins Security Advisory SECURITY-3935 released
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84672

Vulnerability Analysis

The Jenkins Microsoft Entra ID Plugin performs authorization by evaluating both the unique object identifier (objectId) of an Entra group and the group's display name. Permissions configured for a specific object ID are also applied to any group whose display name matches, regardless of the object ID. This dual-key lookup breaks the security guarantee that a unique object identifier provides.

An authenticated attacker who can create Entra groups within the tenant can craft a group whose display name matches a privileged Jenkins group such as jenkins-admins. When the attacker authenticates to Jenkins as a member of the attacker-controlled group, the plugin evaluates the display name match and grants the privileged permissions. This can result in administrative control of the Jenkins instance, allowing arbitrary job configuration, credential access, and code execution on build agents.

Root Cause

The plugin resolves group membership using two identifiers and treats a display name match as sufficient for permission assignment. Display names in Entra ID are not unique and are user-controllable. Authorization decisions must rely on immutable, unique identifiers rather than mutable attributes.

Attack Vector

Exploitation requires network access to the Jenkins instance and low-privileged authenticated access to the associated Entra ID tenant with permission to create groups. The attacker creates a group whose display name collides with a privileged Jenkins group, adds themselves as a member, and authenticates to Jenkins. See the Jenkins Security Advisory 2026-09-02 for full technical detail.

No verified proof-of-concept code is available. The advisory describes the flaw in prose only.

Detection Methods for CVE-2026-84672

Indicators of Compromise

Newly created Entra ID groups whose display names match existing privileged Jenkins group names such as jenkins-admins or role-based names configured in the plugin.
Jenkins authentication events where a user gains administrative permissions from a group whose object ID does not match the object ID configured in Jenkins authorization.
Unexpected job creations, credential exports, or agent configuration changes performed by recently authenticated users.

Detection Strategies

Audit Entra ID group creation logs and correlate new group display names against the list of privileged group names referenced in Jenkins authorization configuration.
Compare the object IDs of groups granting Jenkins permissions against the object IDs authorized in the Jenkins security matrix. Investigate any mismatch.
Review Jenkins access logs for privilege elevation patterns tied to newly created Entra group memberships.

Monitoring Recommendations

Enable Entra ID audit logging for Add group and Add member to group operations and forward events to your SIEM.
Alert on Jenkins configuration changes, credential access, and script console usage originating from accounts recently added to Entra groups.
Restrict Entra ID group creation to administrators using tenant-wide group creation policies.

How to Mitigate CVE-2026-84672

Immediate Actions Required

Upgrade the Jenkins Microsoft Entra ID Plugin to the version released in the Jenkins Security Advisory 2026-09-02.
Restrict Entra ID group creation to trusted administrators until the plugin is upgraded.
Review current Jenkins authorization configuration and confirm every privileged group resolves to the expected Entra object ID.

Patch Information

Jenkins has published fixed plugin versions in the Jenkins Security Advisory 2026-09-02 (SECURITY-3935). Administrators should upgrade the plugin through the Jenkins Update Center and restart the controller. After upgrade, permissions are evaluated using object IDs only.

Workarounds

Disable end-user group creation in Entra ID through the group settings policy so only administrators can create groups.
Remove group-based permission grants from the Jenkins security matrix and rely on direct user assignments until the plugin is patched.
Rename privileged Jenkins groups to unpredictable identifiers to reduce the value of a display-name collision attack as a temporary measure.

bash

# Restrict Entra ID group creation to administrators (PowerShell / Microsoft Graph)
Connect-MgGraph -Scopes "Directory.ReadWrite.All"
Update-MgDirectorySetting -DirectorySettingId <settingId> -Values @(
  @{ Name = "EnableGroupCreation"; Value = "false" }
)