Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Jenkins MCP Server Plugin: Unauthorized Access to Job and Cloud Info

CVE-2025-64132 · published 1 year ago
Summary

An outdated version of the Jenkins MCP Server Plugin does not properly control access to sensitive information and actions. This means attackers can trigger builds and view details about jobs and cloud settings they shouldn't be able to see. Update the plugin to the latest version to fix this issue.

What to do
  • Update jenkins io.jenkins.plugins:mcp-server to version 0.86.v7d3355e6a.
  • Update jenkins mcp_server to version 0.86.v7d3355e6a_a_18 or later.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins io.jenkins.plugins:mcp-server < 0.86.v7d3355e6a
Fix: upgrade to 0.86.v7d3355e6a
– jenkins mcp_server < 0.86.v7d3355e6a_a_18
cpe:2.3:a:jenkins:mcp_server:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud c...
Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published29 Oct 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-mrpq-9jr3-rqq9 · GHSA
CVE-2025-64132 · NVD
Track software like this
Free during beta