Jenkins Mcp Server vulnerabilities

2 CVEs affecting Jenkins Mcp Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-57300, published 2026-06-24.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-57300, published 2026-06-24. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.
• CVE-2025-64132, published 2025-10-29. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud…