CVE-2017-1000390: Jenkins Multijob Plugin Resume Build Action Permission Bypass
Summary
CVE-2017-1000390: Jenkins Multijob plugin did not check permissions in the Resume Build action. Affects org.jenkins-ci.plugins:jenkins-multijob-plugin versions < 1.26. Fixed in 1.26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Multijob plugin is a tool that allows users to define and manage complex build pipelines in Jenkins. It provides a way to orchestrate multiple jobs and control their execution order. The plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins Multijob plugin version 1.25 and earlier did not properly check permissions in the Resume Build action. This allowed any user with Job/Read permission to resume a build, regardless of their actual privileges. The vulnerability was addressed in version 1.26 of the plugin, which introduced a permission check requiring Overall/Administer. This check was later lowered to Job/Build in version 1.27. The lack of permission checks in earlier versions could potentially lead to unauthorized access and manipulation of build processes.
How To Fix
Latest published version: 682.v4ed91b_52d621 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.26
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually modify the plugin code to add the necessary permission checks. However, this is not recommended as it may introduce additional complexities and maintenance overhead. It is strongly advised to upgrade to the latest version of the plugin instead.
Conclusion
The Jenkins Multijob plugin version 1.25 and earlier are vulnerable to a permission bypass issue in the Resume Build action. This vulnerability allows users with Job/Read permission to resume builds without the necessary permission checks. To mitigate this vulnerability, it is recommended to upgrade to version 1.27 or later of the plugin. Users should also ensure that appropriate permissions are assigned to prevent unauthorized access to build actions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:jenkins-multijob-plugin →
FAQ
This vulnerability allows users with Job/Read permission to resume builds, bypassing the intended permission checks. This could potentially lead to unauthorized access and manipulation of build processes.
Versions 1.25 and earlier of the Jenkins Multijob plugin are affected by this vulnerability.
Any user with Job/Read permission can exploit this vulnerability to resume builds without the necessary permission checks.
Yes, this vulnerability has been fixed in version 1.27 of the Jenkins Multijob plugin.
A workaround is to manually modify the plugin code to add the necessary permission checks. However, it is recommended to upgrade to the latest version of the plugin instead.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:jenkins-multijob-plugin.
