CVE-2026-84660

The Jenkins Pipeline: Build Step Plugin (version 599.v4b_67ea_11b_152 and earlier) is vulnerable to a missing authorization check. When a pipeline uses the build step to trigger a downstream build, the plugin fails to verify if the build's authentication possesses the Item/Cancel permission for t...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (>=1.2.0-beta-1, <=1.27.26) +22 more potentially affected by CVE-2026-84660 via org.jenkins-ci.plugins:pipeline-build-step (>=2.0, <=599.v4b_67ea_11b_152)

org.jenkins-ci.plugins:pipeline-build-step MAVEN version =2.0, =1.2.0-beta-1, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.27.17, =1.83.v5bff0e55cd2d, =3.1391.vcbaab9779d75, =877.v578e46d8e5b3, =2.2.0, =2.0, =2.0.5, =2.0.8 - org.jenkins-ci.plugins:convert-to-pipeline 1.0 and more Source...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

EUVD-2026-70123

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84656

A missing permission check in Jenkins versions 2.579 and earlier , as well as LTS 2.568.2 and earlier , allows attackers to access sensitive information. An attacker who possesses Item/Read permission on at least one job can exploit this flaw to read the build parameter names and values of other ...

EUVD-2026-70122

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84657

In Jenkins version 2.579 and earlier (including LTS 2.568.2 and earlier ), the build CLI command fails to verify the Item/Cancel permission when utilizing the -s flag to cancel a build triggered to wait for completion. This flaw allows an attacker with Item/Build permissions to cancel builds init...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84656

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

GHSA-CXQ5-97V7-87J8 Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Summary Orval resolves OpenAPI $refs by fetching remote https URLs and reading local files including absolute / out-of-tree paths, inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF...

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Summary Orval resolves OpenAPI $refs by fetching remote https URLs and reading local files including absolute / out-of-tree paths, inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF...

Malicious Package

Overview google-cloud-internal-build-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

PT-2026-84798

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build...

OS command injection vulnerability on agents in tics

tics 2025.1.1 and earlier does not correctly escape build environment variable values when constructing the OS command it executes. This allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build. tics 2026.1.0 correctly escapes...

Missing permission check allows reading build parameters

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not perform an Item/Read permission check in an HTTP endpoint. This allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to. Jenkins 2.580, LTS 2.568.3 performs a...

Missing permission check in pipeline-build-step allows canceling downstream builds

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. By default, builds run as SYSTEM and are unconstrained unless plugins implement specific additional permission checks. Plugins like Authorize Projec...

Missing permission check allows canceling builds

The build command of the Jenkins CLI can be invoked with the -s flag to wait for a triggered build to complete, canceling the build when the CLI client is interrupted. Jenkins merges multiple requests to build the same job with the same parameters into a single queue item. In Jenkins 2.579 and...