Jenkins MCP Server CVE-2025-64132

Exploitation requires (1) a running instance of the Jenkins MCP Server Plugin at version 0.84.v50ca_24ef83f2 or earlier, and (2) an authenticated account on that Jenkins instance with at least low-level privileges (PR:L) - the flaw is that multiple MCP tools omit permission checks, so any logged-in user can invoke them regardless of their assigned job/cloud permissions. Limiting factors: the attacker must already hold valid Jenkins credentials (no anonymous/unauthenticated path), the MCP Server Plugin must be installed and enabled (not a default Jenkins component), and impact is bounded to reading job/cloud configuration and triggering builds - not full code execution or availability loss.

This is a moderate, authenticated access-control flaw (CWE-862, Missing Authorization) rather than a high-urgency issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) indicates a network-reachable, low-complexity attack requiring low-level privileges (PR:L) - so an authenticated Jenkins user with limited permissions, not an anonymous attacker, is the threat actor. All signals point to limited real-world priority: EPSS is 0.26% (16th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code is referenced. The impact is partial confidentiality and integrity (C:L/I:L) - unauthorized disclosure of job/cloud configuration and the ability to trigger builds - with no availability impact (A:N). No SSVC decision data was provided in the input, so exploitation status, automatability, and technical-impact classifications under that framework cannot be assessed. The signals are consistent with one another (low CVSS, low EPSS, no KEV, no POC), so there is no conflict to flag; this is a 'patch in normal cycle' issue, elevated only where low-privileged users are untrusted.

A low-privileged authenticated Jenkins user with access to an instance running the MCP Server Plugin invokes one of the unprotected MCP tools, which skips permission checks, to enumerate job and cloud configuration they should not see or to trigger builds they are not authorized to run. No public proof-of-concept is referenced, and the attack requires valid (if limited) account credentials given the PR:L vector.