CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84661

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...

CVE-2026-84660

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...

CVE-2026-84661

Jenkins Pipeline: Build Step Plugin version 599.v4b_67ea_11b_152 and earlier contains a missing permission check in the waitForBuild step. When the propagateAbort parameter is set to true, the plugin cancels the downstream build without verifying that the build's associated authentication holds I...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84657

In Jenkins 2.579 and earlier (LTS 2.568.2 and earlier), the build CLI command with the -s flag does not check the Item/Cancel permission when canceling a build after the CLI client is interrupted. Because Jenkins merges duplicate build requests into a single queue item, an attacker holding only I...

PT-2026-84780

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-56280

Cap-go contains a privilege inversion in the /build/logs/:jobId SSE handling prior to version 12.128.2. An abort listener on the SSE stream unconditionally calls cancelBuildOnDisconnect() using the server-side BUILDER_API_KEY, bypassing the app.build_native permission check required by POST /buil...

CVE-2022-24336

In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server...

CVE-2022-24336

In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server...

CVE-2022-24336

In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server...

CVE-2022-24336

JetBrains TeamCity before 2021.2.1 is affected. An unauthenticated attacker can cancel running builds by sending an XML-RPC request to the TeamCity server. Affected versions are those prior to 2021.2.1. Remediation: upgrade to 2021.2.1 or later; as a temporary workaround, restrict access to the X...

CVE-2022-24336

In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server...

JetBrains TeamCity 授权问题漏洞

JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. A security vulnerability exists in JetBrains TeamCity, which stems from the product's failure to validate user identities. An unauthenticated attacker could use the vulnerability to...

CVE-2021-21670

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission...