{"id":"CVE-2026-57300","aliases":["GHSA-mpff-xhg4-vr45"],"title":"Jenkins MCP Server Plugin missing a permission check","summary":"Jenkins MCP Server Plugin missing a permission check","severity":"medium","cvss":4.3,"cwe":["CWE-862"],"vendor":"jenkins","product":"io.jenkins.plugins:mcp-server","ecosystem":"maven","affected":["io.jenkins.plugins:mcp-server < 0.178.vffe5a"],"patched":["io.jenkins.plugins:mcp-server 0.178.vffe5a"],"published":"2026-06-24","updated":"2026-09-25","sourceUpdated":"2026-09-25T19:19:00Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mpff-xhg4-vr45","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57300"},{"url":"https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3759"},{"url":"https://github.com/jenkinsci/mcp-server-plugin/commit/ffe5ae770f3bd7e88c99aea3018263af0b2f9cc4"},{"url":"https://github.com/jenkinsci/mcp-server-plugin/releases/tag/0.178.vffe5a_e770f3b_"},{"url":"https://github.com/advisories/GHSA-mpff-xhg4-vr45"}],"tags":["ghsa","maven"],"epss":0.00281,"epssPercentile":0.18256,"ingestedAt":"2026-09-25T20:17:49.424Z","slug":"CVE-2026-57300","body":"## Overview\n\nJenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.\n\nThis allows attackers with Item/Read permission to obtain the Pipeline script of jobs.\n\nMCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.\n\n## Affected packages\n\n- `io.jenkins.plugins:mcp-server < 0.178.vffe5a`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `io.jenkins.plugins:mcp-server 0.178.vffe5a`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}