CVE-2026-84657: Vulnerability in Jenkins Project Jenkins

In Jenkins versions 2.579 and earlier, and LTS 2.568.2 and earlier, the build CLI command does not enforce the Item/Cancel permission when the -s flag is used to cancel a build waiting for completion. Consequently, users who have Item/Build permission can cancel builds started by other users, bypassing intended permission checks. This is classified under CWE-862 (Missing Authorization). No official remediation or patch information is provided in the available data.

Attackers with Item/Build permission can cancel builds initiated by other users, potentially disrupting build processes and causing denial of service to legitimate build operations. There is no indication of confidentiality or integrity impact beyond the ability to cancel builds. The impact is limited to availability and unauthorized cancellation of build jobs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Item/Build permissions to trusted users only to minimize risk. Monitor Jenkins usage for unauthorized build cancellations as a precaution.