CVE-2021-21647: Jenkins Cloudbees Cd

Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days.

Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build permission.

Affected products

• Jenkins Cloudbees Cd: up to and including 1.1.21

Published 2021-04-21. Last modified 2026-06-17.