CVE-2026-84672: Vulnerability in Jenkins Project Jenkins Microsoft Entra ID (previously Azure AD) Plugin

The Jenkins Microsoft Entra ID Plugin up to version 710.v0b_ff8e9cc2d2 improperly grants group permissions by validating both the unique object ID and the display name of Entra groups. An attacker capable of creating an Entra group with a display name identical to a privileged group can exploit this to inherit the privileged group's permissions, leading to a high-severity privilege escalation vulnerability. This is tracked as CVE-2026-84672 and is associated with CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability affects the plugin in cloud environments, and a patch is available.

Successful exploitation allows an attacker with the ability to create Entra groups to escalate privileges by gaining permissions assigned to privileged groups, potentially leading to full compromise of Jenkins resources protected by these permissions. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

A patch is available for this vulnerability. Since this is a cloud-hosted plugin, the vendor manages remediation for the service. Users should apply the official patch or update to a fixed version as soon as possible to prevent exploitation. Check the Jenkins vendor advisory for the latest patch details and deployment instructions.