Jenkins Pipeline: Build Step Plugin: downstream builds canceled without Item/Cancel permission

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

Impact

The plugin cancels downstream builds without checking that the triggering build's authentication holds Item/Cancel on the downstream job. The vendor split this across two ids in one advisory - CVE-2026-84660 for the build step and CVE-2026-84661 for waitForBuild with propagateAbort - but it is the same missing permission check in the same plugin with the same fix. The practical effect is a low-privilege pipeline author aborting jobs they have no authority over: on a shared CI that fronts a GPU fleet, that means killing another team's training or benchmark pipeline mid-run and wasting the accelerator hours it had already consumed. This is availability and integrity of the build queue, not code execution. Affects Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier.

Who can reach it

An authenticated Jenkins user able to author or run a pipeline that invokes the build or waitForBuild step against a downstream job. No user interaction required.

What to do

Update the Pipeline: Build Step Plugin past 599.v4b_67ea_11b_152 and restart the controller; the record does not name the fixed release. One restart covers both ids. Short CI outage, no impact on running GPU workloads.

References

Related entries

• CloudNativePG instance manager (status server, TCP/8000 control endpoints): A set of operator-only control endpointsNCVD-2026-050-cloudnativepg-instance-manager-s · CloudNativePG instance manager (status server, TCP/8000 control endpoints)Medium
• Slurm (user_name / gid field handling): Slurm trusts the user_name and gid fields carried in job RPCs instead ofCVE-2018-10995 · Slurm (user_name / gid field handling)Medium
• IBM Spectrum LSF (job submission, file permissions): Weak file permissions in the LSF install let a local user changeCVE-2018-1724 · IBM Spectrum LSF (job submission, file permissions)Medium
• AMD IOMMU host buffer access - insufficient RMP checks (AMD-SB-3016): Insufficient RMP checking on IOMMU host bufferCVE-2023-20585 · AMD IOMMU host buffer access - insufficient RMP checks (AMD-SB-3016)Medium
• ZKTeco BioAccess IVS v3.3.1 access control platform: An unauthenticated attacker can open and close any doorCVE-2023-38958 · ZKTeco BioAccess IVS v3.3.1 access control platformMedium
• Intel Data Center GPU Flex Series - Windows driver software: Improper access control in the Flex Series Windows driverCVE-2024-43101 · Intel Data Center GPU Flex Series - Windows driver softwareMedium