CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2026-27100
Medium (4.3) in jenkins jenkins. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.541.2, 2.551.
Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission to obtain information about the existence of jobs, the existence of builds, and if a specified build exists, its display name.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:jenkins
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wfhp-qgm8-5p5c | Maven | org.jenkins-ci.main:jenkins-core | >=2.542 <2.551 | 2.551 |
| GHSA-wfhp-qgm8-5p5c | Maven | org.jenkins-ci.main:jenkins-core | <2.541.2 | 2.541.2 |