PT-2025-44281 · Jenkins · Jenkins Mcp Server Plugin+1

Kevin Guerroudj · Published 2025-10-29 · Updated 2025-12-22 · CVE-2025-64132

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins MCP Server Plugin versions 0.84.v50ca 24ef83f2 and earlier

Description The Jenkins MCP Server Plugin does not properly enforce permission checks in several MCP tools. This allows attackers to initiate builds and access sensitive job and cloud configuration details that they are not authorized to view.

Recommendations Update Jenkins MCP Server Plugin to a version later than 0.84.v50ca 24ef83f2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-64132

GHSA-MRPQ-9JR3-RQQ9

Affected Products

Jenkins

Jenkins Mcp Server Plugin

References · 12

• https://jenkins.io/security/advisory/2025-10-29/#SECURITY-3622 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64132 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mrpq-9jr3-rqq9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64132 · Security Note
• https://github.com/jenkinsci/mcp-server-plugin · Note
• https://github.com/jenkinsci/mcp-server-plugin/commit/59de6a268b4c6844a3a9c6c55a541de183e71a97 · Note
• https://twitter.com/gN3mes1s/status/1983823772080828425 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1on8u60/top_10_trending_cves_03112025 · Reddit Post
• https://twitter.com/CVEnew/status/1983530929093308708 · Twitter Post
• https://t.me/CVEtracker/36054 · Telegram Post
• https://t.me/cveNotify/146529 · Telegram Post
• http://openwall.com/lists/oss-security/2025/10/29/2 · Note