CVE-2025-64132

MEDIUM

Jenkins MCP Server Plugin < 0.84.v50ca_24ef83f2 - Missing Authorization in MCP Tools

Title source: llm
STIX 2.1

Description

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.

References (2)

Core 2
Core References
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2

Scores

CVSS v3 5.4
EPSS 0.0002
EPSS Percentile 5.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
io.jenkins.plugins/mcp-server 0 - 0.86.v7d3355e6aMaven
jenkins/mcp_server < 0.86.v7d3355e6a_a_18
Published Oct 29, 2025
Tracked Since Feb 18, 2026