CVE-2026-53438: Jenkins: Missing permission check allows unauthorized cancellation of queue items

June 10, 2026 (updated August 13, 2026)

A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission, to cancel queue items they do not have permission to view.

References

github.com/advisories/GHSA-mw82-xcg6-gx79
github.com/jenkinsci/jenkins/commit/a154e1108f3170dc036ecbe6b2a89f164ff1554e
github.com/jenkinsci/jenkins/commit/d22d0916148a430dd308760641539d06c0d8a184
nvd.nist.gov/vuln/detail/CVE-2026-53438
www.jenkins.io/security/advisory/2026-06-10/

Code Behaviors & Features

Detect and mitigate CVE-2026-53438 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →