Jenkins core: missing permission check exposes build parameters of jobs a user cannot otherwise see

Impact

A user who holds Item/Read on any single job can read the build parameter names and values of jobs they have no access to at all. Build parameters routinely carry the things that make a CI controller worth attacking: registry paths, cluster and namespace targets, artifact locations, and values that teams treat as semi-secret because the job is supposed to be private. On a shared GPU fleet where one Jenkins controller drives training pipelines for several teams, this collapses the per-job access model into read-everything for anyone with a foothold in the controller. It is disclosure only - no write, no execution - but it is the reconnaissance step ahead of one. Affects Jenkins 2.579 and earlier and LTS 2.568.2 and earlier.

Who can reach it

Any authenticated Jenkins user holding Item/Read on at least one job. No access to the target jobs and no administrative rights are needed.

What to do

Upgrade the controller to the release named in the 2026-09-02 Jenkins advisory (SECURITY-4006); the record does not state the fixed version, so take it from the advisory rather than assuming one. Cost is a controller restart - the queue pauses, agents reconnect, and running builds are lost unless drained first. No GPU node impact. Until then, treat build parameters on that controller as readable by every authenticated user and move anything sensitive into the credentials store.

References

Related entries

• Jenkins Script Security Plugin: form submission exposes the script approval configuration to attackersCVE-2026-84658 · Jenkins Script Security Plugin (script approval configuration)Medium
• Jenkins Script Security Plugin: missing permission check lets attackers disable global sandbox enforcementCVE-2026-84659 · Jenkins Script Security Plugin (global sandbox enforcement setting)Medium
• Jenkins LDAP plugin: Stapler data binding lets a low-privileged user make the controller connect to any URLCVE-2026-84662 · Jenkins LDAP plugin (Stapler data binding, attacker-specified connection URL)Medium
• Jenkins Parameterized Remote Trigger plugin: remote trigger tokens stored unencrypted in job config.xmlCVE-2026-84676 · Jenkins Parameterized Remote Trigger plugin (tokens stored unencrypted in job config.xml)Medium
• GitLab CE/EE: developer-role user can modify package registry metadata without maintainer rightsCVE-2026-8667 · GitLab CE/EE (package registry metadata authorization)Medium
• Infineon cryptographic library (ECDSA) in security microcontrollers: Electromagnetic side channel in Infineon's ECDSACVE-2024-45678 · Infineon cryptographic library (ECDSA) in security microcontrollersMedium