Is CVE-2026-53438 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53438 being exploited in the wild.

How severe is CVE-2026-53438?

Medium severity, with a CVSS score of 4.3, published 10 June 2026.

Which products and versions are affected?

org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=0,fixed=2.555.3.

Is there a fix for CVE-2026-53438?

Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53438 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-53438?

Check whether you run org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53438: Jenkins missing permission check in queue item cancellation

CVE-2026-53438 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Jenkins is an open-source automation server widely used to orchestrate build pipelines and job execution. This vulnerability allows users with limited permissions (able to cancel jobs but not read them) to cancel queued job executions they should not have visibility into. An attacker exploiting this flaw could disrupt job execution, interfere with CI/CD workflows, and potentially mask their activity or introduce build delays without proper audit trail controls.

Technologies: org.jenkins-ci.main:jenkins-core (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-53438 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53438 being exploited in the wild.
How severe is CVE-2026-53438?: Medium severity, with a CVSS score of 4.3, published 10 June 2026.
Which products and versions are affected?: org.jenkins-ci.main:jenkins-core (Maven) ECOSYSTEM:introduced=0,fixed=2.555.3.
Is there a fix for CVE-2026-53438?: Yes. org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53438 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-53438?: Check whether you run org.jenkins-ci.main:jenkins-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.jenkins-ci.main:jenkins-core (Maven): upgrade to 2.555.3 or later

# set org.jenkins-ci.main:jenkins-core to 2.555.3 in your pom.xml or build.gradle

Technical details

This is a missing authorization vulnerability (CWE-862) in an HTTP endpoint that handles queue item cancellation. The root cause is an incomplete fix of SECURITY-2278 from June 2021, where the endpoint was not updated to enforce Item/Read permission checks alongside Item/Cancel checks. An attacker with Item/Cancel permission but lacking Item/Read permission can directly invoke this endpoint to cancel queue items they do not have permission to view or access. The vulnerability is network-accessible and requires only that the attacker possess the Item/Cancel permission (which may be granted to users in limited roles). No user interaction is required. Jenkins 2.568 and LTS 2.555.3 fix this by adding the missing Item/Read permission check in the affected endpoint.

Affected products

Jenkins Project Jenkins 2.567 and earlier; LTS 2.555.2 and earlier

Identifiers

CVE-2026-53438
GHSA-mw82-xcg6-gx79

Timeline

2026-06-10: disclosed: Published in Jenkins Security Advisory 2026-06-10
2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.