Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information a...
Date: 2025-10
Affected: jenkins/mcp_server
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-64131
CVE-2025-64132
CVE-2025-64134
CVE-2025-64143
CVE-2025-64144
CVE-2025-64146
CWE: CWE-294
CWE-311
CWE-611
CWE-862
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.


Mitigations:

Architectural layers (MAESTRO):