CVE-2026-53438: Jenkins Permission Bypass Allows Unauthorized Queue Cancellation

Technical summary

CVE-2026-53438 is a missing authorization check (CWE-862) in Jenkins that fails to validate Item/Read permission when processing queue cancellation requests. The vulnerability affects Jenkins versions up to 2.567 (main release line) and 2.555.2 (LTS line). An attacker with Item/Cancel permission but without Item/Read permission can send API or UI requests to cancel arbitrary queue items, bypassing the intended permission hierarchy. The CVSS 3.1 score of 4.3 (MEDIUM) reflects low attack complexity and no user interaction required, though impact is limited to integrity (ability to cancel jobs, not access sensitive data or execute code).

Business impact

Organizations running Jenkins as a CI/CD orchestration platform should assess whether hostile or semi-trusted users hold Item/Cancel permission without Item/Read permission. The primary risk is job queue disruption—attackers could cancel critical builds, causing pipeline delays and potential deployment failures. In multi-tenant or shared Jenkins environments, this becomes a denial-of-service vector against team workflows. The impact is operational rather than data-compromising, but consistent cancellation attacks could hamper release cycles and testing velocity.

Affected systems

Jenkins open-source (versions 2.567 and earlier) and Jenkins LTS (versions 2.555.2 and earlier) are affected. Organizations should verify their installed version via Manage Jenkins > System Information. Any deployment offering Item/Cancel permission to users (common in role-based access control setups) is in scope. Jenkins on any platform (on-premises, cloud-hosted, containerized) is vulnerable if running an affected version.

Exploitability

Exploitation requires authenticated access with Item/Cancel permission—an attacker cannot exploit this from an unauthenticated state. Given that Item/Cancel is a narrow permission (typically granted to build operators or CI engineers), the attack surface is constrained to insider or compromised-credential scenarios. No known public exploits exist. The attack is trivial to execute once permissions are present (a single API call or UI button click), but initial access barriers limit widespread abuse. CVSS vector (PR:L) reflects the low privilege requirement; this is not a critical remote code execution or privilege escalation vulnerability.

Remediation

Upgrade Jenkins to a patched version released after June 10, 2026. Check the official Jenkins security advisory for specific patch versions (2.568 or later for the main release line, and the corresponding LTS update). If upgrading is not immediately feasible, restrict Item/Cancel permission to users who also have Item/Read permission through Jenkins' built-in authorization strategy (e.g., matrix-based security or role-strategy plugin). Audit existing permissions and remove Item/Cancel from users who should not view jobs.

Patch guidance

Jenkins maintainers have issued fixes addressing the permission check. Administrators should verify the patched version against the official Jenkins security advisory (https://www.jenkins.io/security/advisory/) to confirm the exact version numbers for both the main and LTS release lines. Plan upgrades during maintenance windows to avoid build queue disruption. After patching, test that users with Item/Cancel permission can still cancel their own builds while being blocked from canceling builds they lack Item/Read permission for. Monitor Jenkins logs for any cancellation attempts post-patch to verify new enforcement.

Detection guidance

Monitor Jenkins audit logs and API request logs for unusual queue cancellation activity, especially from users with limited permissions. Alert on Item/Cancel API calls (e.g., POST /queue/item/<id>/cancelQueue) from accounts that lack Item/Read on the targeted jobs. Review job permission assignments in Jenkins configuration to identify users with Item/Cancel but not Item/Read (likely an unintended configuration). Consider deploying a Jenkins security plugin or SIEM integration to correlate permission assignments with observed API calls and flag anomalies.

Why prioritize this

This vulnerability merits medium priority: it requires authentication, has no active KEV or ransomware association, and does not enable data theft or remote code execution. However, in shared or multi-tenant Jenkins environments, it should be prioritized above low-risk issues because it enables targeted job disruption. Organizations with strict access controls isolating Item/Cancel from Item/Read can defer patching briefly; those with overlapping or overly broad permissions should patch sooner. The moderate CVSS score (4.3) aligns with operational impact rather than critical risk.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) Network-accessible attack vector (AV:N), (2) Low attack complexity (AC:L—no special conditions needed), (3) Low privileges required (PR:L—must have Item/Cancel permission), (4) No user interaction (UI:N), (5) Unchanged scope (S:U), (6) No confidentiality impact (C:N), and (7) Low integrity impact (I:L—can cancel jobs but not corrupt data or gain elevated access). The score does not account for business context (disruption to CI/CD pipelines can be material) or environmental factors; organizations should consider increasing internal risk ratings if Jenkins controls critical deployments.

Frequently asked questions