Description

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T16:17:30.657Z",
  "pubdate": "2026-09-02T16:17:30.657Z",
  "executiveSummary": "A critical authorization flaw exists within the Jenkins Pipeline: Build Step Plugin version 599.v4b_67ea_11b_152 and earlier. The vulnerability stems from an inadequate access control check during the execution of downstream build processes triggered via the build step.\nThis missing permission validation allows an authenticated user to perform a denial-of-service (DoS) action on downstream jobs. Specifically, the plugin fails to verify if the security context initiating the build possesses the 'Item/Cancel' permission on the targeted downstream project. As a result, unauthorized users can force the cancellation of downstream builds that they would otherwise be restricted from interacting with.\nThe risk implication is significant within environments utilizing complex CI/CD pipelines, as it allows for the disruption of build integrity and delivery schedules. The vulnerability requires the attacker to have at least 'Job/Build' permissions on the upstream pipeline to trigger the faulty build step. Once the build step is executed, the plugin erroneously proceeds to interact with downstream jobs without the appropriate authorization gate, enabling the unauthorized cancellation of privileged or sensitive downstream build tasks.\nNo external network exposure is required, as the exploitation is contained within the Jenkins environment. Organizations are advised to update the plugin to the latest available version to enforce proper authorization constraints.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the downstream build trigger mechanism within the Jenkins Pipeline: Build Step Plugin. When a Jenkins Pipeline executes a build step, the plugin attempts to manage the lifecycle of the triggered downstream project. However, the logic governing the cancellation of these triggered builds fails to perform a formal 'checkPermission' call against the Jenkins security realm before invoking cancellation routines.\nIn the Jenkins security model, the 'Item/Cancel' permission is required to terminate a build process. The affected versions of the plugin ignore this requirement, effectively allowing the security context of the parent (upstream) build—or the user triggering the parent build—to override standard access control lists (ACLs) when the downstream job is targeted for cancellation. Even if the user triggering the process lacks the specific permission to manage or cancel the downstream job, the plugin's internal execution flow proceeds as if elevated privileges were present.\nThe attack flow follows these steps: 1) The attacker initiates an upstream pipeline build that contains a 'build' step targeting a downstream job. 2) The attacker manipulates the upstream pipeline execution to trigger the downstream job. 3) The plugin processes the request and subsequently monitors or interacts with the downstream build lifecycle. 4) Due to the missing permission check, the plugin inadvertently permits the cancellation of the downstream build process regardless of the initiator's actual permission set for that specific downstream item.\nThis behavior violates the principle of least privilege, as the plugin should be bounded by the security context of the user or system account running the upstream build. Because the plugin does not validate authorization at the boundary between the upstream triggering mechanism and the downstream job controller, it creates an escalation of privilege that facilitates unauthorized build termination. The component responsible for this flaw is the core build invocation logic within the plugin that manages inter-job dependencies. Affected versions include all releases up to and including 599.v4b_67ea_11b_152. Post-exploitation impact is primarily characterized by targeted denial-of-service on build pipelines, which may lead to significant delays in continuous integration and continuous deployment (CI/CD) workflows, potentially breaking automation chains that rely on the successful completion of specific downstream jobs."
}