Medium github · GHSA-mpff-xhg4-vr45

Jenkins MCP Server Plugin missing a permission check

Published Jun 24, 2026 CVSS 4.3

Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.

This allows attackers with Item/Read permission to obtain the Pipeline script of jobs.

MCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.

Agentic / MCP

Affected AI Products

mcp server

View original source

Get the weekly digest. Every Monday: top AI security stories of the week. Free.