Description

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T16:17:31.833Z",
  "pubdate": "2026-09-02T16:17:31.833Z",
  "executiveSummary": "The Jenkins Microsoft Entra ID plugin contains a critical security flaw involving improper authorization validation when processing group assignments. The vulnerability stems from the plugin's reliance on both unique object identifiers (OIDs) and non-unique display names to authorize user access permissions.\nThis design failure permits an attacker capable of creating a Microsoft Entra ID group to perform a naming collision attack. By crafting a group with a display name identical to an existing, high-privilege group, an attacker can trick the plugin into granting them the security permissions associated with the privileged entity.\nThe vulnerability affects version 710.v0b_ff8e9cc2d2 and earlier. The impact is significant, as it enables unauthorized privilege escalation, potentially granting attackers administrative access to the Jenkins environment. Successful exploitation requires an attacker to have sufficient permissions within the organization's Microsoft Entra ID tenant to create new groups, but does not require prior access to the target Jenkins instance.",
  "technicalDetails": "The core of the vulnerability lies in the normalization and validation logic within the Jenkins Microsoft Entra ID plugin's authorization middleware. When evaluating group-based permissions, the plugin concurrently references the Microsoft Entra ID group object ID (OID) and the human-readable display name as valid identifiers for access control lists (ACLs).\nIn Microsoft Entra ID, object IDs are globally unique, immutable identifiers, whereas display names are mutable and non-unique. The plugin's failure to strictly enforce the use of OIDs for authorization decisions creates an ambiguity that can be exploited by an attacker.\nThe attack flow proceeds as follows: First, an attacker identifies a high-privileged group within the target Jenkins configuration that is authorized via the Microsoft Entra ID plugin. If the authorization was configured or resolved using the display name, the plugin becomes vulnerable. The attacker then accesses their own Microsoft Entra ID tenant—or an environment where they possess 'Group Create' permissions—and creates a new group assigned the exact display name of the target high-privilege group.\nWhen the victim or attacker authenticates to the affected Jenkins instance, the plugin queries the Entra ID graph for group memberships. Upon retrieving the attacker's group list, the plugin processes the display name of the newly created malicious group. Due to the lack of strict OID-only verification, the plugin matches the attacker's group display name against the policy defined for the legitimate, privileged group. Consequently, the plugin's authorization engine elevates the attacker's session permissions to match those assigned to the privileged group.\nThis vulnerability effectively bypasses role-based access control (RBAC) mechanisms. Because the plugin does not differentiate between the authoritative OID and the collision-prone display name, it authorizes the attacker's session despite the disparity between the identity attributes. The impact is a full privilege escalation, allowing the attacker to perform administrative actions in Jenkins, such as running arbitrary jobs, altering build configurations, or gaining control over credentials stored within the CI/CD pipeline, provided the target group held those permissions.\nThe vulnerable component is the group authorization mapping logic within the plugin. All versions up to and including 710.v0b_ff8e9cc2d2 are susceptible to this vector because they lack an architectural constraint forcing the exclusive use of unique OIDs for security principal identification."
}