CVE-2026-84660 in Build Step Plugin
Summary
by MITRE • 09/02/2026
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The Jenkins Pipeline Build Step Plugin, specifically versions 599.v4b_67ea_11b_152 and earlier, contains a critical authorization bypass vulnerability that affects the execution of pipeline jobs utilizing the build step to trigger downstream builds. This flaw stems from an insufficient permission check within the plugin's logic for handling job cancellation events. When a Jenkins agent or controller receives a signal to cancel a running build, it typically verifies whether the user initiating the cancellation possesses Item/Cancel permissions on that specific job. However, in this vulnerable configuration, the validation process fails to properly enforce these access controls when dealing with builds triggered via the pipeline build step mechanism. Consequently, any authenticated user who can trigger or interact with such pipelines may inadvertently or maliciously cause downstream jobs to be terminated without having the requisite administrative privileges for those target jobs.
This vulnerability represents a significant deviation from the principle of least privilege and proper authorization enforcement within continuous integration environments. The technical flaw allows an attacker with limited permissions on one job to disrupt operations in other, potentially more critical or sensitive jobs that are linked through pipeline dependencies. By exploiting this missing permission check, an adversary can cause denial-of-service conditions for downstream builds, leading to wasted computational resources, interrupted deployment pipelines, and potential data integrity issues if partial artifacts are left behind. The impact is particularly severe in complex multi-stage pipelines where the failure of a single intermediate step can cascade into broader project delays or failures.
From a classification perspective, this issue aligns with CWE-284, which describes Improper Access Control, as well as CWE-732, pertaining to Incorrect Permission Assignment for Critical Resource. In terms of offensive security frameworks, the exploitation technique maps to MITRE ATT&CK tactic TA0005, Defense Evasion, specifically through techniques that involve manipulating system processes or permissions to disrupt operations without direct unauthorized access to the target resource itself. The vulnerability highlights a gap in how Jenkins handles permission inheritance and validation across different stages of pipeline execution, particularly when external triggers are involved.
To mitigate this risk, organizations running affected versions must upgrade the Jenkins Pipeline Build Step Plugin to version 599.v4b_67ea_11b_153 or later, where the authorization logic has been corrected to strictly enforce Item/Cancel permissions before allowing a downstream build cancellation. Until an update is applied, administrators should review their pipeline configurations and consider restricting who can trigger builds that utilize this specific step. Additionally, implementing robust audit logging for job cancellation events can help in detecting unauthorized attempts to disrupt pipelines. It is also advisable to regularly review Jenkins global security settings and ensure that role-based access control plugins are configured correctly to minimize the blast radius of such permission bypasses across the CI/CD infrastructure.