EUVD-2026-33712
GHSA-978x-993q-q6rw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in hekmon8 Jenkins-server-mcp 0.1.0. This vulnerability affects the function jobPath of the file src/index.ts of the component get_build_status/get_build_log/trigger_build. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery (SSRF) in hekmon8/Jenkins-server-mcp 0.1.0 allows a remote, low-privileged attacker to forge outbound HTTP requests from the server by manipulating the jobPath parameter across the get_build_status, get_build_log, and trigger_build functions in src/index.ts. The flaw stems from absent or insufficient validation of user-supplied job path values before they are used to construct server-side requests to Jenkins. Publicly available exploit code exists (disclosed via GitHub issue #4); no vendor patch has been released and the maintainer has not responded to the disclosure.
Technical ContextAI
Jenkins-server-mcp is a Model Context Protocol (MCP) server (version 0.1.0) authored by hekmon8 that exposes Jenkins CI/CD pipeline operations - build status queries, log retrieval, and build triggering - to AI agent frameworks via a structured tool interface. The vulnerable code resides in src/index.ts within the jobPath handling logic shared across three tool functions. CWE-918 (Server-Side Request Forgery) identifies the root cause: the application constructs a server-side URL or path using attacker-controlled input without adequate canonicalization, allowlist enforcement, or scheme/host restriction, enabling the server process to be directed to issue requests to arbitrary internal or external endpoints. The CPE string cpe:2.3:a:hekmon8:jenkins-server-mcp:*:*:*:*:*:*:*:* covers all versions with no upper-bound, indicating no fixed release has been identified.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer had not responded to the disclosure as of the report date. Organizations using Jenkins-server-mcp 0.1.0 should take the following specific compensating controls: (1) Restrict network access to the MCP server endpoint so only trusted, authenticated clients can reach it - this raises the bar from any low-privileged network user to a known authorized agent, reducing but not eliminating risk. (2) Deploy an egress firewall or HTTP proxy rule on the host running Jenkins-server-mcp to block or allowlist outbound connections, preventing the SSRF from reaching internal-only services such as cloud metadata endpoints (e.g., 169.254.169.254) or other intranet resources. (3) If the tool is not actively needed, disable or remove it from the agent framework configuration entirely until a patched release is available. Monitor the GitHub repository (https://github.com/hekmon8/Jenkins-server-mcp/) and VulDB entry (https://vuldb.com/vuln/367569) for patch releases. Note that egress filtering may break legitimate Jenkins API calls if misconfigured - allowlist only confirmed Jenkins server addresses rather than blocking by default.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today