Cloudanix VulnDB

CVE-2025-64132

Medium · 5.4

Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools

CVSS

5.4

EPSS

0.3%

Published

Oct 29, 2025

CISA due date

—

The record

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in several MCP tools. This allows to do the following: - Attackers with Item/Read permission can obtain information about the configured SCM in a job despite lacking Item/Extended Read permission (`getJobScm`). - Attackers with Item/Read permission can trigger new builds of a job despite lacking Item/Build permission (`triggerBuild`). - Attackers without Overall/Read permission can retrieve the names of configured clouds (`getStatus`). MCP Server Plugin 0.86.v7d3355e6a_a_18 performs permission checks for the affected MCP tools.

Affected packages

Ecosystem Package Introduced Fixed
Maven io.jenkins.plugins:mcp-server 0 0.86.v7d3355e6a

Related vulnerabilities