Description

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T16:17:30.757Z",
  "pubdate": "2026-09-02T16:17:30.757Z",
  "executiveSummary": "A vulnerability exists in the Jenkins Pipeline: Build Step Plugin due to an inadequate permission validation mechanism during the execution of downstream build management operations.\nSpecifically, the 'waitForBuild' step fails to verify the Item/Cancel permission when the 'propagateAbort' parameter is invoked, leading to an unauthorized cancellation of downstream builds.\nThe vulnerability affects Jenkins Pipeline: Build Step Plugin versions 599.v4b_67ea_11b_152 and earlier.\nThis flaw allows authenticated users with sufficient access to trigger pipelines to disrupt downstream job execution, even when those users lack the explicit 'Cancel' permission on the targeted downstream project.\nThe impact includes potential service disruption, race conditions in build pipelines, and the bypassing of granular access control policies implemented within the Jenkins security realm.\nNo external network exposure is required, as the exploit is performed within the Jenkins user interface or via API by an authenticated user, making it an internal privilege escalation and unauthorized action vulnerability.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of authorization checks within the 'waitForBuild' step implementation of the Jenkins Pipeline: Build Step Plugin. When a pipeline is configured to use the 'propagateAbort' parameter, the plugin logic assumes responsibility for managing the state of a downstream build, including the ability to terminate it if the upstream pipeline fails or is aborted.\nDuring the execution of this logic, the plugin fails to perform a formal access control check against the current security context (the Authentication object associated with the build's execution). By bypassing the 'Item/Cancel' permission requirement, the plugin allows an upstream build process—operating under the identity of the triggered user or service account—to issue a cancellation request to a downstream job that the user would otherwise be restricted from modifying.\nThe attack flow proceeds as follows: 1) An attacker initiates a Jenkins Pipeline build that utilizes the 'waitForBuild' step with the 'propagateAbort' parameter enabled. 2) The attacker directs this pipeline to await a downstream job for which they lack 'Cancel' permissions. 3) The attacker then causes the upstream pipeline to trigger a termination event (such as manually aborting the upstream build). 4) The plugin, while processing the 'propagateAbort' logic, proceeds to invoke the cancellation method on the downstream job object without checking if the Authentication object (the user context) holds the required Item/Cancel permission. 5) The downstream job is forcefully terminated by the Jenkins controller, effectively bypassing the security constraints enforced by the Jenkins Role-Based Access Control (RBAC) or Access Control List (ACL) system.\nThis vulnerability highlights a failure in the principle of least privilege, as the plugin elevates the implicit authority of the upstream job to include administrative actions on downstream resources. The lack of validation creates a mechanism for users to deny service to pipelines they are not authorized to manage, leading to potential workflow sabotage or interference in multi-project orchestration environments. The vulnerability is persistent across all versions up to 599.v4b_67ea_11b_152, as the code path for the 'propagateAbort' logic lacks the necessary calls to Jenkins' 'checkPermission()' methods on the downstream Job object."
}