All vulnerabilities
CVE-2026-57300GHSA-mpff-xhg4-vr45

io.jenkins.plugins:mcp-server: Jenkins MCP Server Plugin missing a permission check

Jenkins Project io.jenkins.plugins:mcp-servermavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.178.vffe5aFixed versionGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 0.178.vffe5aio.jenkins.plugins:mcp-server, mavenGitHub<dependency><groupId>io.jenkins.plugins</groupId><artifactId>mcp-server</artifactId><version>0.178.vffe5a</version></dependency>
  • 0.178.vffe5aio.jenkins.plugins:mcp-server, MavenOSV<dependency><groupId>io.jenkins.plugins</groupId><artifactId>mcp-server</artifactId><version>0.178.vffe5a</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.

This allows attackers with Item/Read permission to obtain the Pipeline script of jobs.

MCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.

Text from GitHub Advisory Database

Affected versions 41

  • io.jenkins.plugins:mcp-server, maven< 0.178.vffe5aGitHub
  • Jenkins MCP Server Pluginunaffected: 0.172.174.v9f72da_90a_710CVE List
  • Jenkins MCP Server Pluginunaffected: 0.178.vffe5a_e770f3b_ and laterCVE List
  • io.jenkins.plugins:mcp-server, Mavenfrom first release, fixed in 0.178.vffe5aOSV
  • io.jenkins.plugins:mcp-server, Maven0.102.vf677b_eb_da_e4fOSV
  • io.jenkins.plugins:mcp-server, Maven0.104.v935c459ca_ee2OSV
  • io.jenkins.plugins:mcp-server, Maven0.109.vea_d3ec3083f1OSV
  • io.jenkins.plugins:mcp-server, Maven0.116.v335308141e4eOSV
  • io.jenkins.plugins:mcp-server, Maven0.119.v479294b_419a_7OSV
  • io.jenkins.plugins:mcp-server, Maven0.130.v7837b_2a_5447eOSV
  • io.jenkins.plugins:mcp-server, Maven0.138.v7c6a_22ee9160OSV
  • io.jenkins.plugins:mcp-server, Maven0.148.v6b_c057f27738OSV
  • io.jenkins.plugins:mcp-server, Maven0.149.ve5cd2f59de01OSV
  • io.jenkins.plugins:mcp-server, Maven0.158.v8e18e64dd93cOSV
  • io.jenkins.plugins:mcp-server, Maven0.16.vc9132432728dOSV
  • io.jenkins.plugins:mcp-server, Maven0.166.v6a_0b_15a_7fd59OSV
  • io.jenkins.plugins:mcp-server, Maven0.167.v7c50149715fa_OSV
  • io.jenkins.plugins:mcp-server, Maven0.168.v13951585050dOSV
  • io.jenkins.plugins:mcp-server, Maven0.17.v941ed9da_c023OSV
  • io.jenkins.plugins:mcp-server, Maven0.172.174.v9f72da_90a_710OSV
  • io.jenkins.plugins:mcp-server, Maven0.172.v9db_cb_43cdb_ccOSV
  • io.jenkins.plugins:mcp-server, Maven0.174.v2747878a_eedb_OSV
  • io.jenkins.plugins:mcp-server, Maven0.177.v629fdb_2557feOSV
  • io.jenkins.plugins:mcp-server, Maven0.25.v59ca_c2d5ffc5OSV
  • io.jenkins.plugins:mcp-server, Maven0.26.v4a_0d810a_7f71OSV
  • io.jenkins.plugins:mcp-server, Maven0.27.v4034b_d4c4cb_5OSV
  • io.jenkins.plugins:mcp-server, Maven0.33.vecd845512255OSV
  • io.jenkins.plugins:mcp-server, Maven0.34.v9f214cb_76168OSV
  • io.jenkins.plugins:mcp-server, Maven0.35.v03801a_87ff6dOSV
  • io.jenkins.plugins:mcp-server, Maven0.37.v5d2d8c089e8b_OSV
  • io.jenkins.plugins:mcp-server, Maven0.41.vdd84b_1430491OSV
  • io.jenkins.plugins:mcp-server, Maven0.46.v43ff45cf7fe5OSV
  • io.jenkins.plugins:mcp-server, Maven0.57.vc17d46a_5d10b_OSV
  • io.jenkins.plugins:mcp-server, Maven0.77.veb_c7b_a_b_f0445OSV
  • io.jenkins.plugins:mcp-server, Maven0.84.v50ca_24ef83f2OSV
  • io.jenkins.plugins:mcp-server, Maven0.86.v7d3355e6a_a_18OSV
  • io.jenkins.plugins:mcp-server, Maven0.88.vde1b_2e64212cOSV
  • io.jenkins.plugins:mcp-server, Maven0.89.v1518513fe167OSV
  • io.jenkins.plugins:mcp-server, Maven0.90.v46fb_a_0b_0e4a_3OSV
  • io.jenkins.plugins:mcp-server, Maven0.92.v575c7c143c44OSV
  • io.jenkins.plugins:mcp-server, Maven0.95.vb_c1a_8b_ca_216fOSV

References 5