CVE-2021-21670: Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of j...

Security readout for executives and security teams

This Jenkins flaw lets a user stop queued jobs or abort builds when they have Item/Cancel permission, even if they should not be able to read that job. The main business risk is disruption to CI/CD pipelines and unauthorized interference with builds, not code execution based on the provided sources. Exposure is most likely in Jenkins environments with granular job permissions where some users or groups have Item/Cancel without Item/Read. Systems on versions at or below Jenkins 2.299 or LTS 2.289.1 should be reviewed against the Jenkins advisory. Prioritize remediation where Jenkins supports production releases, regulated delivery, or high-value build pipelines. This is not sourced as actively exploited, but it can affect release reliability and separation of duties in CI/CD environments. Mitigation focus: Review the Jenkins advisory for the vendor-designated fixed release.; Upgrade affected Jenkins controllers according to Jenkins project guidance.; Audit roles granting Item/Cancel without Item/Read..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.