Executive brief
The Jenkins Microsoft Entra ID authentication plugin allows administrators to grant permissions to users based on their Entra groups. The plugin grants permissions using both a group's unique object ID and its display name. An attacker who can create a new Entra group with a display name matching an existing privileged group can gain all permissions assigned to that group, potentially compromising CI/CD pipelines and sensitive build systems.
Technical details
This is a privilege escalation vulnerability in Jenkins Microsoft Entra ID Plugin version 710.v0b_ff8e9cc2d2 and earlier. The vulnerability stems from the plugin granting Entra group permissions based on both the group's globally unique object ID and its display name. An attacker with permissions to create Entra groups can create a new group with a display name identical to an existing privileged group. When the plugin performs authorization checks, it matches on the display name (in addition to the object ID), causing the attacker's newly created group to be treated as the legitimate privileged group. This allows unauthorized access to Jenkins features and projects. The attack requires the ability to create groups in the target Entra directory, and affects all versions up to and including 710.v0b_ff8e9cc2d2.
Affected products
- Jenkins Microsoft Entra ID Plugin 710.v0b_ff8e9cc2d2 and earlier
Timeline
- 2026-09-02: disclosed
- 2026-09-02: advisory: Jenkins Security Advisory 2026-09-02