PkgSeer

Vulnerability GHSA-mrpq-9jr3-rqq9

Medium Risk
MEDIUM RISK
CVSS Score: 5.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
11 months ago
October 29, 2025 at 03:31 PM UTC
Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools
==0.16.vc9132432728d, ==0.17.v941ed9da_c023, ==0.25.v59ca_c2d5ffc5, ==0.26.v4a_0d810a_7f71, ==0.27.v4034b_d4c4cb_5, ==0.33.vecd845512255, ==0.34.v9f214cb_76168, ==0.35.v03801a_87ff6d, ==0.37.v5d2d8c089e8b_, ==0.41.vdd84b_1430491, ==0.46.v43ff45cf7fe5, ==0.57.vc17d46a_5d10b_, ==0.77.veb_c7b_a_b_f0445, ==0.84.v50ca_24ef83f2
==0.16.vc9132432728d, ==0.17.v941ed9da_c023, ==0.25.v59ca_c2d5ffc5, ==0.26.v4a_0d810a_7f71, ==0.27.v4034b_d4c4cb_5, ==0.33.vecd845512255, ==0.34.v9f214cb_76168, ==0.35.v03801a_87ff6d, ==0.37.v5d2d8c089e8b_, ==0.41.vdd84b_1430491, ==0.46.v43ff45cf7fe5, ==0.57.vc17d46a_5d10b_, ==0.77.veb_c7b_a_b_f0445, ==0.84.v50ca_24ef83f2

Summary

Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools

Details

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in several MCP tools.

This allows to do the following:

  • Attackers with Item/Read permission can obtain information about the configured SCM in a job despite lacking Item/Extended Read permission (getJobScm).

  • Attackers with Item/Read permission can trigger new builds of a job despite lacking Item/Build permission (triggerBuild).

  • Attackers without Overall/Read permission can retrieve the names of configured clouds (getStatus).

MCP Server Plugin 0.86.v7d3355e6a_a_18 performs permission checks for the affected MCP tools.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk
3 months ago
Jenkins MCP Server Plugin missing a permission check
==0.102.vf677b_eb_da_e4f, ==0.104.v935c459ca_ee2, ==0.109.vea_d3ec3083f1, ==0.116.v335308141e4e, ==0.119.v479294b_419a_7, ==0.130.v7837b_2a_5447e, ==0.138.v7c6a_22ee9160, ==0.148.v6b_c057f27738, ==0.149.ve5cd2f59de01, ==0.158.v8e18e64dd93c, ==0.16.vc9132432728d, ==0.166.v6a_0b_15a_7fd59, ==0.167.v7c50149715fa_, ==0.168.v13951585050d, ==0.17.v941ed9da_c023, ==0.172.174.v9f72da_90a_710, ==0.172.v9db_cb_43cdb_cc, ==0.174.v2747878a_eedb_, ==0.177.v629fdb_2557fe, ==0.25.v59ca_c2d5ffc5, ==0.26.v4a_0d810a_7f71, ==0.27.v4034b_d4c4cb_5, ==0.33.vecd845512255, ==0.34.v9f214cb_76168, ==0.35.v03801a_87ff6d, ==0.37.v5d2d8c089e8b_, ==0.41.vdd84b_1430491, ==0.46.v43ff45cf7fe5, ==0.57.vc17d46a_5d10b_, ==0.77.veb_c7b_a_b_f0445, ==0.84.v50ca_24ef83f2, ==0.86.v7d3355e6a_a_18, ==0.88.vde1b_2e64212c, ==0.89.v1518513fe167, ==0.90.v46fb_a_0b_0e4a_3, ==0.92.v575c7c143c44, ==0.95.vb_c1a_8b_ca_216f GHSA-mpff-xhg4-vr45
==0.102.vf677b_eb_da_e4f, ==0.104.v935c459ca_ee2, ==0.109.vea_d3ec3083f1, ==0.116.v335308141e4e, ==0.119.v479294b_419a_7, ==0.130.v7837b_2a_5447e, ==0.138.v7c6a_22ee9160, ==0.148.v6b_c057f27738, ==0.149.ve5cd2f59de01, ==0.158.v8e18e64dd93c, ==0.16.vc9132432728d, ==0.166.v6a_0b_15a_7fd59, ==0.167.v7c50149715fa_, ==0.168.v13951585050d, ==0.17.v941ed9da_c023, ==0.172.174.v9f72da_90a_710, ==0.172.v9db_cb_43cdb_cc, ==0.174.v2747878a_eedb_, ==0.177.v629fdb_2557fe, ==0.25.v59ca_c2d5ffc5, ==0.26.v4a_0d810a_7f71, ==0.27.v4034b_d4c4cb_5, ==0.33.vecd845512255, ==0.34.v9f214cb_76168, ==0.35.v03801a_87ff6d, ==0.37.v5d2d8c089e8b_, ==0.41.vdd84b_1430491, ==0.46.v43ff45cf7fe5, ==0.57.vc17d46a_5d10b_, ==0.77.veb_c7b_a_b_f0445, ==0.84.v50ca_24ef83f2, ==0.86.v7d3355e6a_a_18, ==0.88.vde1b_2e64212c, ==0.89.v1518513fe167, ==0.90.v46fb_a_0b_0e4a_3, ==0.92.v575c7c143c44, ==0.95.vb_c1a_8b_ca_216f GHSA-mpff-xhg4-vr45
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
11 months ago
October 29, 2025 at 03:31 PM UTC
Last Modified
10 months ago
November 05, 2025 at 09:07 PM UTC