The Jenkins Pipeline: Build Step Plugin has a missing permission check that allows any build that uses the waitForBuild step with the propagateAbort parameter to cancel downstream builds, even when the user running the build does not have Item/Cancel rights on the downstream job. This flaw effectively permits a user to interrupt or reject builds that they should not be able to control, potentially disrupting continuous integration pipelines. The weakness is a classic case of missing authorization (CWE-862).

The vulnerable plugin releases up to version 599.v4b_67ea_11b_152. Any Jenkins instance running this plugin in that version range is affected, regardless of the underlying operating system or environment. Administrators should examine sites that use these versions and verify whether the waitForBuild step with propagateAbort is employed in any job definitions.

With a CVSS score of 5.4 the vulnerability is classified as moderate severity. The EPSS score is not available, so the precise likelihood of exploitation is unknown, but the issue is theoretically exploitable by an attacker who can trigger the waitForBuild step with propagateAbort – typically an authenticated user with build privileges. The vulnerability is not listed in the CISA KEV catalog, suggesting no known mass exploitation. Nevertheless, the impact could be significant to development teams that rely on uninterrupted pipeline execution.