CVE-2021-21670: Jenkins

Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days.

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.

Affected products

• Jenkins Jenkins: before 2.289.2 (fixed in 2.289.2); before 2.300 (fixed in 2.300)

Published 2021-06-30. Last modified 2026-06-17.