CVE-2026-84672 in Microsoft Entra ID Plugin
Summary
by MITRE • 09/02/2026
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The Jenkins Microsoft Entra ID plugin serves as a critical integration point between Jenkins continuous integration servers and Microsoft Entra ID, formerly known as Azure Active Directory, facilitating identity-based access control through SAML or OAuth protocols. In versions 710.v0b_ff8e9cc2d2 and earlier, the authentication logic contains a significant flaw in how it resolves group memberships to assign permissions within Jenkins. Specifically, when determining which groups a user belongs to for authorization purposes, the plugin does not exclusively rely on the immutable unique object identifier assigned by Microsoft Entra ID. Instead, it also accepts or prioritizes the display name of the group during permission mapping operations. This design choice introduces a critical ambiguity in identity resolution that can be exploited through social engineering and administrative manipulation within the directory service.
This vulnerability is classified under CWE-284 Improper Access Control because it allows an attacker to bypass intended security restrictions by manipulating input parameters used for authorization decisions. The core technical flaw lies in the lack of strict validation against unique identifiers when mapping external group claims to internal Jenkins roles or permissions. By relying on display names, which are mutable and user-controllable attributes within Microsoft Entra ID, the system fails to enforce a one-to-one correspondence between an identity claim and its corresponding permission set. An attacker with sufficient privileges in the Microsoft Entra tenant can create a new security group that shares the exact same display name as a privileged Jenkins-managed group. When users are added to this maliciously named group, the Jenkins plugin incorrectly associates them with the permissions intended for the legitimate privileged group due to the string match on the display name rather than verification of the unique object ID.
The operational impact of this vulnerability is severe, potentially leading to full system compromise depending on the configuration of the Jenkins instance. If an attacker can create such a colliding group and add their own user account or compromised accounts to it, they will inherit all permissions assigned to that display name within Jenkins. This could include administrative rights, access to sensitive build configurations, ability to execute arbitrary code in build agents, or modification of pipeline scripts. Since Jenkins often serves as the central hub for software delivery pipelines with high-privilege credentials stored internally, gaining unauthorized admin access allows an attacker to exfiltrate source code, inject malicious artifacts into production builds, or pivot further into internal networks connected via CI/CD workflows. This represents a direct path from identity manipulation in the directory service to complete control over the development infrastructure.
From a threat modeling perspective aligned with MITRE ATT&CK techniques, this vulnerability facilitates privilege escalation through T1098.004 SSH Authorized Keys Manipulation or more accurately T1078 Valid Accounts combined with T1546.003 Windows Registry Permissions Modification if considering the broader context of identity abuse, but most directly it aligns with T1078.002 Cloud Accounts where attackers exploit misconfigured permissions in cloud directories to gain elevated access. The attack vector typically involves an insider threat or a compromised account with group creation privileges within Microsoft Entra ID, making detection difficult without rigorous auditing of directory changes and Jenkins permission logs.
Mitigation strategies must focus on enforcing strict identity validation and updating software components immediately. Organizations should upgrade the Jenkins Microsoft Entra ID plugin to version 710.v0b_ff8e9cc2d3 or later where this logic has been corrected to exclusively use unique object identifiers for group resolution, eliminating the ambiguity introduced by display names. In environments where immediate patching is not feasible, administrators can implement compensating controls such as restricting permissions in Jenkins based on user principal names rather than group memberships whenever possible. Additionally, implementing strict governance policies within Microsoft Entra ID that prevent users from creating groups with names identical to existing privileged groups can reduce the risk of exploitation. Regular auditing of directory changes and monitoring for anomalous permission assignments in Jenkins logs are also recommended to detect potential abuse attempts early.