GitHub Advisoryadvisory · Maven

GHSA-mrpq-9jr3-rqq9 Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools

MEDIUM Published 2025-10-29 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-64132
Ecosystem
Maven
Packages
io.jenkins.plugins:mcp-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-862
Reviewed
2025-10-29

Affected packages

• Maven io.jenkins.plugins:mcp-server: < 0.86.v7d3355e6a → fixed in 0.86.v7d3355e6a

Description

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in several MCP tools. This allows to do the following: • Attackers with Item/Read permission can obtain information about the configured SCM in a job despite lacking Item/Extended Read permission (`getJobScm`). • Attackers with Item/Read permission can trigger new builds of a job despite lacking Item/Build permission (`triggerBuild`). • Attackers without Overall/Read permission can retrieve the names of configured clouds (`getStatus`). MCP Server Plugin 0.86.v7d3355e6a_a_18 performs permission checks for the affected MCP tools.

Related

Alias · CVE (1)

  • CVE-2025-64132 Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References