Executive brief
Jenkins Pipeline: Build Step Plugin is a plugin for Jenkins that enables pipeline-based CI/CD workflows to orchestrate multi-stage builds. A missing permission check allows attackers to cancel downstream builds when using the waitForBuild step with propagateAbort enabled, even when they lack proper authorization on those jobs, potentially disrupting production workflows and deployments.
Technical details
The Jenkins Pipeline: Build Step Plugin versions up to 599.v4b_67ea_11b_152 contain an authorization bypass in the waitForBuild step when the propagateAbort parameter is enabled. The vulnerability stems from a missing permission check that fails to verify Item/Cancel permission on downstream jobs before canceling them. An attacker with access to a Jenkins pipeline can exploit this by invoking waitForBuild with propagateAbort to cancel downstream jobs regardless of their authorization level. The fix involves adding proper permission validation before allowing cancellation of awaited builds.
Affected products
- Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier
Timeline
- 2026-09-02: disclosed