Jenkins MCP Server Plugin missing a permission check

MITTEL 4.3CVE-2026-57300 · GHSA-mpff-xhg4-vr45 · Published 24/06/2026 · updated 25/10/2026

Kurz gesagt

CVE-2026-57300 ist eine Schwachstelle (MITTEL (CVSS 4.3)) in io.jenkins.plugins:mcp-server, mcp server (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.28%, höher als bei 20.6% aller Schwachstellen.
Abhilfe: auf 0.178.vffe5a oder neuer aktualisieren.

Package	Affected versions	Patched versions
io.jenkins.plugins:mcp-server Maven	`< 0.178.vffe5a`	`0.178.vffe5a`
mcp server jenkins	`≤ 0.177.v629fdb_2557fe`	No fix yet

Description

Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.

This allows attackers with Item/Read permission to obtain the Pipeline script of jobs.

MCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.

NVD description

A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.

References

nvd.nist.gov/vuln/detail/CVE-2026-57300 · ADVISORY
jenkinsci/mcp-server-plugin commit ffe5ae7 · WEB
jenkinsci/mcp-server-plugin · PACKAGE
jenkinsci/mcp-server-plugin release 0.178.vffe5a_e770f3b_ · WEB
jenkins.io/security/advisory/2026-06-24 · WEB

Weitere Schwachstellen in io.jenkins.plugins:mcp-server

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

io.jenkins.plugins:mcp-server

Maven

< 0.178.vffe5a

0.178.vffe5a

mcp server

jenkins

≤ 0.177.v629fdb_2557fe

No fix yet

Description

Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.

This allows attackers with Item/Read permission to obtain the Pipeline script of jobs.

MCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.

NVD description

A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.