Jenkins MCP Server Plugin EUVD-2026-38781

The attacker must be authenticated to the Jenkins instance and hold at least Item/Read permission on the targeted job - unauthenticated exploitation is not possible per the PR:L CVSS vector. The Jenkins MCP Server Plugin must be installed and active on the Jenkins controller. Exploitation is bounded to jobs the attacker can already see (Item/Read scope), meaning lateral discovery to entirely hidden jobs is not enabled. What is bypassed is the additional Run/Replay or Job/Build permission that would normally gate access to replay script content. Non-default configurations that restrict network access to the Jenkins controller (e.g., internal-only deployments) further limit exposure to internal threat actors only.

All available signals converge on low real-world priority. The CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible, low-complexity flaw but is bounded by the PR:L requirement (confirmed authenticated access), the S:U scope (no lateral movement), and a C:L confidentiality impact. EPSS at 0.17% in the 7th percentile indicates the vulnerability is statistically unlikely to be exploited opportunistically. SSVC assessment confirms exploitation status of none and technical impact of only partial. No POC code has been identified and the vulnerability is not listed in CISA KEV. The primary real-world risk is insider threat or privilege escalation for reconnaissance - a low-privileged Jenkins user reading pipeline scripts to identify build secrets or internal infrastructure topology before escalating further. SSVC automatable: no is consistent with this being a targeted, post-authentication reconnaissance technique rather than an unauthenticated mass-exploitation vector. This is a legitimate security finding but not a critical incident response priority for most organizations.

An authenticated Jenkins user who holds only Item/Read permission on a CI/CD pipeline job sends a crafted HTTP request to the Jenkins MCP Server Plugin API endpoint that retrieves replay scripts, bypassing the intended permission gate. The plugin returns the full Groovy pipeline script from a previous build run, which may contain hardcoded environment variable references, infrastructure hostnames, or logic the attacker can use for further reconnaissance. No public exploit code exists for this specific path at time of analysis, but the attack is straightforward for any developer familiar with Jenkins internal API conventions.