CVE-2018-1000015

4.8 mediumEPSS 1.0%

On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline `node` blocks on those agents due to incorrect permissions checks in Pipeline: Nodes and Processes plugin 2.17 and earlier.

Severity

CVSS 3.0

4.8 medium

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2018-01-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:pipeline_nodes_and_processes

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9r7f-rqhw-j8h8	Maven	org.jenkins-ci.plugins.workflow:workflow-durable-task-step	<2.18	2.18

References

https://jenkins.io/security/advisory/2018-01-22/
https://jenkins.io/security/advisory/2018-01-22/

Check your stack JSON