Jenkins core: build CLI -s flag cancels other users' builds without the Item/Cancel permission

Impact

The build CLI command does not check Item/Cancel when the -s flag is used to cancel a build it was waiting on, so a user holding only Item/Build can kill builds started by someone else. On a GPU fleet this is availability against the most expensive resource in the building: long training and benchmark jobs that have been queued behind scarce accelerators lose their hours of work and go back to the end of the queue, and repeated use is a cheap way for one tenant to starve another without ever holding a cancel permission. The impact is denial and disruption only - no data access, no execution - and Jenkins rates attack complexity high because it depends on the specific waiting-build flow. Affects Jenkins 2.579 and earlier and LTS 2.568.2 and earlier.

Who can reach it

An authenticated Jenkins user with Item/Build permission and CLI access to the controller. Item/Cancel is not required, which is the whole flaw.

What to do

Upgrade the controller to the release named in the 2026-09-02 Jenkins advisory (SECURITY-4015); the record does not state a fixed version, so take it from the advisory. Cost is a controller restart - queue pauses, agents reconnect, running builds lost unless drained. No GPU node reboot needed. Restricting CLI access on the controller narrows who can reach the affected command in the meantime.

References

Related entries

• AMD IOMMU register interface - ASP coherency: Improper access control on the IOMMU register interface lets a privilegedCVE-2025-54509 · AMD IOMMU register interface - ASP coherencyMedium
• AGESA Boot Loader (ABL) - SPI ROM header input validation (AMD-SB-3003): The AGESA Boot Loader does not properlyCVE-2021-46772 · AGESA Boot Loader (ABL) - SPI ROM header input validation (AMD-SB-3003)Low
• Redis: Lua environment weakness lets a user inject code that runs with another Redis user's privilegesCVE-2022-24735 · RedisLow
• Slurm (X11 forwarding, xauth magic-cookie setup): Slurm shells out to xauth to install a user's X11 magic cookie, andCVE-2020-27746 · Slurm (X11 forwarding, xauth magic-cookie setup)Low
• Zabbix: Some setup.php steps reachable by unauthenticated usersCVE-2022-23134 · ZabbixLow
• SkyPilot (sky/users/server.py, user ID derivation from username): User IDs are derived with a weak hash of theCVE-2026-13482 · SkyPilot (sky/users/server.py, user ID derivation from username)Low