{"id":"CVE-2026-57300","aliases":["EUVD-2026-38781","GHSA-mpff-xhg4-vr45"],"status":"published","title":"Jenkins MCP Server Plugin missing a permission check","description":"A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00281,"percentile":0.20813,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-06-24T13:20:15Z","modified":"2026-10-25T22:10:00Z","fixes":[{"ecosystem":"Maven","package":"io.jenkins.plugins:mcp-server","fixed_in":["0.178.vffe5a"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.jenkins.plugins:mcp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.178.vffe5a"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.jenkins.plugins:mcp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.178.vffe5a"}]}],"versions":["0.102.vf677b_eb_da_e4f","0.104.v935c459ca_ee2","0.109.vea_d3ec3083f1","0.116.v335308141e4e","0.119.v479294b_419a_7","0.130.v7837b_2a_5447e","0.138.v7c6a_22ee9160","0.148.v6b_c057f27738","0.149.ve5cd2f59de01","0.158.v8e18e64dd93c","0.16.vc9132432728d","0.166.v6a_0b_15a_7fd59","0.167.v7c50149715fa_","0.168.v13951585050d","0.17.v941ed9da_c023","0.172.174.v9f72da_90a_710","0.172.v9db_cb_43cdb_cc","0.174.v2747878a_eedb_","0.177.v629fdb_2557fe","0.25.v59ca_c2d5ffc5","0.26.v4a_0d810a_7f71","0.27.v4034b_d4c4cb_5","0.33.vecd845512255","0.34.v9f214cb_76168","0.35.v03801a_87ff6d","0.37.v5d2d8c089e8b_","0.41.vdd84b_1430491","0.46.v43ff45cf7fe5","0.57.vc17d46a_5d10b_","0.77.veb_c7b_a_b_f0445","0.84.v50ca_24ef83f2","0.86.v7d3355e6a_a_18","0.88.vde1b_2e64212c","0.89.v1518513fe167","0.90.v46fb_a_0b_0e4a_3","0.92.v575c7c143c44","0.95.vb_c1a_8b_ca_216f"]}],"products":[{"vendor":"jenkins","product":"mcp_server"},{"vendor":"jenkins project","product":"jenkins mcp server plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3759","tags":["vendor-advisory","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57300","tags":["advisory"]},{"url":"https://github.com/jenkinsci/mcp-server-plugin/commit/ffe5ae770f3bd7e88c99aea3018263af0b2f9cc4","tags":["web"]},{"url":"https://github.com/jenkinsci/mcp-server-plugin/releases/tag/0.178.vffe5a_e770f3b_","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mpff-xhg4-vr45"},{"url":"https://github.com/jenkinsci/mcp-server-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-57300","description":"A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.","status":"published","published":"2026-06-24T13:20:15.718Z","modified":"2026-06-24T14:36:37.59Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-38781","description":"A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.","status":"published","published":"2026-06-24T13:20:15Z","modified":"2026-06-24T14:36:37Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:30.642628Z"}],"ghsa":[{"id":"GHSA-mpff-xhg4-vr45","title":"Jenkins MCP Server Plugin missing a permission check","description":"Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.\n\nThis allows attackers with Item/Read permission to obtain the Pipeline script of jobs.\n\nMCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.","status":"published","published":"2026-06-24T15:31:48Z","modified":"2026-09-25T19:19:00Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2026-57300","description":"A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.","status":"published","published":"2026-06-24T14:17:36.14Z","modified":"2026-10-25T22:10:00.15Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"GHSA-mpff-xhg4-vr45","title":"Jenkins MCP Server Plugin missing a permission check","description":"Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.\n\nThis allows attackers with Item/Read permission to obtain the Pipeline script of jobs.\n\nMCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.","status":"published","published":"2026-06-24T15:31:48Z","modified":"2026-09-25T19:30:10.04763246Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:52.170928Z"}]}}