Description
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | unspecified – ≤ 2.299, unspecified – ≤ LTS 2.289.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | butane | 0.12.1-2.rhaos4.8.el8 | RHSA-2021:3820 |
| Red Hat OpenShift 4 | jenkins | 2.289.2.1628252553-1.el8 | RHSA-2021:3820, RHBA-2021:3396, RHBA-2021:3033 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.289.2 | 2.289.2 | GHSA-q4wp-8c99-69pw |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.292, < 2.300 | 2.300 | GHSA-q4wp-8c99-69pw |
Advisories 3
- RHSA-2021:3820 Red Hat Security Advisory: OpenShift Container Platform 4.8.15 packages and security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHBA-2021:3033 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.7.24 packages update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHBA-2021:3396 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6.44 packages update Red Hat Security Advisories (RHSA) · Aug 5, 2026