| Package | Affected versions | Patched versions |
|---|---|---|
| io.jenkins.plugins:mcp-server | < 0.178.vffe5a | 0.178.vffe5a |
| mcp server | ≤ 0.177.v629fdb_2557fe |
Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.
This allows attackers with Item/Read permission to obtain the Pipeline script of jobs.
MCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free