Jenkins Pipeline: Build Step Plugin: downstream builds cancelled without Item/Cancel permission check

Impact

The plugin cancels a downstream build without checking that the triggering build's authentication holds Item/Cancel on that downstream job. The vendor split this across 2 ids in one advisory item (SECURITY-3870) - one for the build step, one for waitForBuild with propagateAbort - but it is the same missing permission check with the same fix. A user who can author or influence any pipeline can abort jobs in projects they were deliberately not given control over. On a fleet where CI drives long GPU work - training runs, benchmark sweeps, accelerator-pinned image builds - a cancellation costs GPU-hours plus a re-queue behind whatever else is in the scheduler. Authorization gap with an availability and build-queue integrity payload; confidentiality is untouched.

Who can reach it

An authenticated Jenkins user able to author or run a pipeline that invokes the build or waitForBuild step against a downstream job. No user interaction required.

What to do

Upgrade the Pipeline: Build Step plugin past 599.v4b_67ea_11b_152 per SECURITY-3870 in the 2026-09-02 Jenkins advisory (the advisory names that version and earlier as affected without stating a fixed release, so take the current plugin version), then restart the controller. One upgrade and one restart covers both ids. Cost is a short queue pause and agent reconnects; running builds are lost unless drained first, and running GPU workloads are unaffected.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• Jenkins Pipeline: Groovy Libraries plugin: CSRF lets an unauthenticated attacker delete library cachesCVE-2026-84663 · Jenkins Pipeline: Groovy Libraries Plugin (shared library cache deletion endpoint)Medium
• Jenkins GitLab plugin: global connection URL can be overwritten, sending admin API tokens to an attackerCVE-2026-84664 · Jenkins GitLab Plugin (global connection configuration via Stapler data binding)Medium
• Jenkins Job Configuration History Plugin: attackers redirect history storage to a directory of their choosingCVE-2026-84666 · Jenkins Job Configuration History Plugin (history recording config via Stapler data binding)Medium
• Jenkins XL Deploy plugin: any user with Overall/Read can enumerate stored credential IDsCVE-2026-84674 · Jenkins XebiaLabs XL Deploy Plugin (credentials ID enumeration)Medium
• Jenkins update-center2: unescaped plugin metadata gives stored XSS on plugin download index pagesCVE-2026-84677 · Jenkins update-center2 (plugin metadata escaping on download index pages)Medium
• GitLab: MCP-scoped tokens can act beyond their intended scopeCVE-2026-92874 · GitLab CE/EE (MCP-scoped token authorization)Medium