Jenkins MCP Server Plugin (missing permission checks in MCP tools): Several tools exposed by the MCP Server Plugin do

Impact

Several tools exposed by the MCP Server Plugin do not check the caller's Jenkins permissions, so any authenticated user - including a low-privilege account or an LLM agent wired to the MCP endpoint - can read job and cloud configuration they should not see and start builds they should not be able to start. On a fleet where Jenkins drives GPU image builds, driver rollouts and node provisioning, cloud configuration is a map of the build fleet and its credentials plumbing, and the ability to trigger a build is the ability to run code on a build agent. Because the surface is an MCP endpoint, prompt injection into an agent that holds a Jenkins token is enough to exercise it without a human in the loop.

Who can reach it

Network, authenticated: any user who can reach the Jenkins controller's MCP endpoint with a valid account or API token. No admin rights needed.

What to do

Update the MCP Server Plugin past 0.84.v50ca_24ef83f2 and restart the Jenkins controller to load it; the plugin is not a core component, so this is a controller restart in a maintenance slot, not a node operation. If you cannot update promptly, disable the plugin or cut network access to the MCP endpoint, and review build history for builds started by accounts that should not have had the permission.

References

Related entries

• Jenkins Extensible Choice Parameter Plugin: CSRF lets an unauthenticated attacker run sandboxed GroovyCVE-2025-64133 · Jenkins Extensible Choice Parameter Plugin (CSRF to sandboxed Groovy execution)Medium
• Jenkins Publish to Bitbucket Plugin: low-privilege users can make Jenkins send stored credentials to an attacker URLCVE-2025-64149 · Jenkins Publish to Bitbucket Plugin (credential capture via unauthorized connection)Medium
• Ansible Automation Platform UI: DOM XSS via unvalidated `next` redirect parameterCVE-2026-106033 · Red Hat Ansible Automation Platform UI (redirect route `next` parameter)Medium
• GitLab CE/EE: missing enforcement checks let an authenticated user bypass SAML SSO restrictionsCVE-2026-12910 · GitLab CE/EE (SAML SSO sign-in enforcement)Medium
• Grafana: an Editor can mark a dashboard file-provisioned, making it undeletable by adminsCVE-2026-13720 · Grafana dashboard API (grafana.app/managedBy provisioning annotations)Medium
• GitLab EE: missing namespace validation lets a user apply compliance frameworks from namespaces they cannot accessCVE-2026-4398 · GitLab EE self-managed (compliance framework namespace validation)Medium