CVE-2026-84661: Vulnerability in Jenkins Project Jenkins Pipeline: Build Step Plugin

The vulnerability in Jenkins Pipeline: Build Step Plugin version 599.v4b_67ea_11b_152 and earlier is due to a missing permission check. Specifically, when the waitForBuild step uses the propagateAbort parameter, downstream builds can be canceled even if the build's authentication lacks the required Item/Cancel permission on the downstream job. This is classified under CWE-862 (Missing Authorization). The CVSS 3.1 score is 5.4 (medium severity) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker or user with limited privileges can cause downstream builds to be canceled without having the proper cancellation permissions on those downstream jobs. This could disrupt build processes and cause denial of service to build jobs, impacting availability and integrity of the build pipeline.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor the Jenkins Project advisories for updates and apply patches once available.