CVE-2026-84657: Jenkins

Medium severity, CVSS 4.2. EPSS: 0.3% chance of exploitation in the next 30 days.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users.

Affected products

• Jenkins Jenkins: up to and including 2.568.2; up to and including 2.579

Published 2026-09-02. Last modified 2026-09-15.