Executive brief
Jenkins is an open-source automation server widely used for continuous integration and deployment. The build CLI command has an authorization flaw that allows users with permission to trigger builds to cancel builds initiated by other users, even if they lack explicit cancellation authority. This could disrupt production deployments, interrupt critical automation tasks, or cause denial-of-service impacts on shared CI/CD infrastructure.
Technical details
The build CLI command in Jenkins fails to enforce the Item/Cancel permission check when the -s flag (synchronous/wait for completion) is used to cancel a running build. An attacker with Item/Build permission can invoke the build command with -s and use it to cancel any active build, not just their own. The vulnerability exists in Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier. The fix is included in Jenkins 2.580 and LTS 2.568.3, which properly validate the Item/Cancel permission before allowing build cancellation via CLI.
Affected products
- Jenkins Jenkins 2.579 and earlier, LTS 2.568.2 and earlier
Timeline
- 2026-09-02: disclosed