CVE-2026-84657: 
Jenkins vulnerability analysis and mitigation

CVE-2026-84657 is a missing authorization vulnerability (SECURITY-4015) in Jenkins core that allows authenticated attackers with only Item/Build permission to cancel builds initiated by other users. It affects Jenkins 2.579 and earlier, and LTS 2.568.2 and earlier. The vulnerability was disclosed on September 2, 2026, as part of a broader Jenkins security advisory. It carries a CVSS v3.1 base score of 4.2 (Medium) (Jenkins Advisory, GitHub Advisory).

The root cause is a missing authorization check (CWE-862) in the Jenkins CLI build command when the -s flag is used to wait for a triggered build to complete. Jenkins merges multiple requests to build the same job with the same parameters into a single queue item; when an attacker triggers a build that merges with an existing queue item and then interrupts the CLI command, the cancellation is executed without verifying that the attacker holds the Item/Cancel permission. Exploitation requires network access and a low-privileged authenticated account with Item/Build permission, but has high attack complexity due to the timing requirement of merging with an existing queue item (Jenkins Advisory, GitHub Advisory).

Successful exploitation allows an attacker to cancel builds started by other users without the required Item/Cancel permission, disrupting CI/CD pipelines and build operations. The vulnerability has no confidentiality impact, but results in low integrity and low availability impacts — specifically, unauthorized modification of build state and potential disruption of automated delivery workflows. There is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Jenkins Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the advisory publication date (Feedly). The NVD SSVC assessment confirms exploitation is "none" and the attack is not automatable. The EPSS score is approximately 0.166% (6th percentile), indicating a low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify a target build: The attacker, holding Item/Build permission on a job, identifies a build currently queued or running that was initiated by another user with the same job and parameters.
2. Trigger a merging build: The attacker invokes the Jenkins CLI build command with the -s flag targeting the same job and identical parameters, causing Jenkins to merge the attacker's request with the existing queue item.
3. Interrupt the CLI command: The attacker interrupts (e.g., via Ctrl+C or SIGINT) the CLI client process while it is waiting for the build to complete.
4. Build cancellation occurs: Jenkins cancels the merged build without checking whether the attacker holds Item/Cancel permission, effectively canceling the build originally started by another user (Jenkins Advisory).

• Logs: Jenkins audit logs or build logs showing a build cancellation event where the canceling user does not match the user who initiated the build; CLI access logs showing build -s invocations followed by abrupt disconnections.
• Process/Behavior: Unexpected build cancellations on jobs where the canceling account only holds Item/Build (not Item/Cancel) permission; repeated CLI build invocations with identical parameters to an already-queued job from a low-privileged account.

Jenkins has released fixed versions: Jenkins 2.580 (weekly) and LTS 2.568.3, both of which enforce an Item/Cancel permission check when the build CLI command is used with the -s flag. Administrators should upgrade to these versions or later as the primary remediation. No configuration-based workaround is documented; restricting CLI access or tightening Item/Build permission grants to trusted users can reduce exposure in the interim (Jenkins Advisory).

The vulnerability was reported through the Jenkins Bug Bounty Program sponsored by the European Commission, as noted in the official advisory. No notable independent researcher commentary, social media discussion, or significant media coverage specific to CVE-2026-84657 has been identified, likely due to its moderate severity relative to other critical issues disclosed in the same advisory (Jenkins Advisory).