CVE-2026-57300
Jenkins MCP Server Plugin missing a permission check
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.
- Record
CVE-2026-57300- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-38781
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.
- Record
EUVD-2026-38781- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mpff-xhg4-vr45
Jenkins MCP Server Plugin missing a permission check
Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.
This allows attackers with Item/Read permission to obtain the Pipeline script of jobs.
MCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.
- Record
GHSA-mpff-xhg4-vr45- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.
- Record
CVE-2026-57300- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-mpff-xhg4-vr45
Jenkins MCP Server Plugin missing a permission check
Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.
This allows attackers with Item/Read permission to obtain the Pipeline script of jobs.
MCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.
- Record
GHSA-mpff-xhg4-vr45- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.jenkins.plugins:mcp-serverMaven |
before 0.178.vffe5a | 0.178.vffe5a |
io.jenkins.plugins:mcp-serverMaven |
before 0.178.vffe5a, plus listed versions 0.102.vf677b_eb_da_e4f0.104.v935c459ca_ee20.109.vea_d3ec3083f10.116.v335308141e4e0.119.v479294b_419a_7 Show 32 moreShow less0.130.v7837b_2a_5447e0.138.v7c6a_22ee91600.148.v6b_c057f277380.149.ve5cd2f59de010.158.v8e18e64dd93c0.16.vc9132432728d0.166.v6a_0b_15a_7fd590.167.v7c50149715fa_0.168.v13951585050d0.17.v941ed9da_c0230.172.174.v9f72da_90a_7100.172.v9db_cb_43cdb_cc0.174.v2747878a_eedb_0.177.v629fdb_2557fe0.25.v59ca_c2d5ffc50.26.v4a_0d810a_7f710.27.v4034b_d4c4cb_50.33.vecd8455122550.34.v9f214cb_761680.35.v03801a_87ff6d0.37.v5d2d8c089e8b_0.41.vdd84b_14304910.46.v43ff45cf7fe50.57.vc17d46a_5d10b_0.77.veb_c7b_a_b_f04450.84.v50ca_24ef83f20.86.v7d3355e6a_a_180.88.vde1b_2e64212c0.89.v1518513fe1670.90.v46fb_a_0b_0e4a_30.92.v575c7c143c440.95.vb_c1a_8b_ca_216f |
0.178.vffe5a |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-57300 is a medium vulnerability (CVSS 4.3) in Jenkins Mcp Server, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in io.jenkins.plugins:mcp-server 0.178.vffe5a.
References
jenkins.io/security/advisory/2026-06-24
nvd.nist.gov/vuln/detail/CVE-2026-57300
github.com/jenkinsci/mcp-server-plugin/commit/ffe5ae770f3bd7e88c99aea3018263af0b2f9cc4