diff --git a/core/modules/contextual/contextual.module b/core/modules/contextual/contextual.module
index f2d537693ee9..8d734f19e063 100644
--- a/core/modules/contextual/contextual.module
+++ b/core/modules/contextual/contextual.module
@@ -107,6 +107,11 @@ function contextual_help($route_name, RouteMatchInterface $route_match) {
  * @see \Drupal\contextual\ContextualController::render()
  */
 function contextual_preprocess(&$variables, $hook, $info) {
+  $variables['#cache']['contexts'][] = 'user.permissions';
+  if (!\Drupal::currentUser()->hasPermission('access contextual links')) {
+    return;
+  }
+
   // Determine the primary theme function argument.
   if (!empty($info['variables'])) {
     $keys = array_keys($info['variables']);
diff --git a/core/modules/contextual/src/Tests/ContextualDynamicContextTest.php b/core/modules/contextual/src/Tests/ContextualDynamicContextTest.php
index 38955ab63b6a..1f24f54a1824 100644
--- a/core/modules/contextual/src/Tests/ContextualDynamicContextTest.php
+++ b/core/modules/contextual/src/Tests/ContextualDynamicContextTest.php
@@ -105,6 +105,12 @@ class ContextualDynamicContextTest extends WebTestBase {
     $this->assertIdentical($json[$ids[2]], '<ul class="contextual-links"><li class="entitynodeedit-form"><a href="' . base_path() . 'node/3/edit">Edit</a></li></ul>');
     $this->assertIdentical($json[$ids[3]], '');
 
+    // Verify that link language is properly handled.
+    $node3->addTranslation('it')->set('title', $this->randomString())->save();
+    $id = 'node:node=' . $node3->id() . ':changed=' . $node3->getChangedTime() . '&langcode=it';
+    $this->drupalGet('node', ['language' => ConfigurableLanguage::createFromLangcode('it')]);
+    $this->assertContextualLinkPlaceHolder($id);
+
     // Authenticated user: can access contextual links, cannot edit articles.
     $this->drupalLogin($this->authenticatedUser);
     $this->drupalGet('node');
@@ -126,19 +132,13 @@ class ContextualDynamicContextTest extends WebTestBase {
     $this->drupalLogin($this->anonymousUser);
     $this->drupalGet('node');
     for ($i = 0; $i < count($ids); $i++) {
-      $this->assertContextualLinkPlaceHolder($ids[$i]);
+      $this->assertNoContextualLinkPlaceHolder($ids[$i]);
     }
     $this->renderContextualLinks(array(), 'node');
     $this->assertResponse(403);
     $this->renderContextualLinks($ids, 'node');
     $this->assertResponse(403);
 
-    // Verify that link language is properly handled.
-    $node3->addTranslation('it')->set('title', $this->randomString())->save();
-    $id = 'node:node=' . $node3->id() . ':changed=' . $node3->getChangedTime() . '&langcode=it';
-    $this->drupalGet('node', ['language' => ConfigurableLanguage::createFromLangcode('it')]);
-    $this->assertContextualLinkPlaceHolder($id);
-
     // Get a page where contextual links are directly rendered.
     $this->drupalGet(Url::fromRoute('menu_test.contextual_test'));
     $this->assertEscaped("<script>alert('Welcome to the jungle!')</script>");