CVE-2025-64132

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3622	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:mcp_server:*:*:*:*:*:jenkins:*:*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 y anteriores no realiza comprobaciones de permisos en múltiples herramientas MCP, permitiendo a los atacantes activar compilaciones y obtener información sobre la configuración de trabajos y de la nube a la que no deberían tener acceso.

Information

Published : 2025-10-29 14:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-64132

Mitre link : CVE-2025-64132

CVE.ORG link : CVE-2025-64132

JSON object : View

Products Affected

jenkins

mcp_server

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-64132", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64132", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-29T14:05:29.975005Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "jenkinsci-cert@googlegroups.com", "affectedData": [{"vendor": "Jenkins Project", "product": "Jenkins MCP Server Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "0.84.v50ca_24ef83f2"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-29T14:15:57.310", "references": [{"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3622", "tags": ["Vendor Advisory"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/29/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access."}, {"lang": "es", "value": "Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 y anteriores no realiza comprobaciones de permisos en m\u00faltiples herramientas MCP, permitiendo a los atacantes activar compilaciones y obtener informaci\u00f3n sobre la configuraci\u00f3n de trabajos y de la nube a la que no deber\u00edan tener acceso."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:mcp_server:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "5693C7AF-4054-4B81-81F8-4B8DE2A52804", "versionEndExcluding": "0.86.v7d3355e6a_a_18"}], "operator": "OR"}]}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com"}