---
id: CVE-2026-57300
aliases:
  - GHSA-mpff-xhg4-vr45
title: Jenkins MCP Server Plugin missing a permission check
summary: Jenkins MCP Server Plugin missing a permission check
severity: medium
cvss: 4.3
cwe:
  - CWE-862
vendor: jenkins
product: 'io.jenkins.plugins:mcp-server'
ecosystem: maven
affected:
  - 'io.jenkins.plugins:mcp-server < 0.178.vffe5a'
patched:
  - 'io.jenkins.plugins:mcp-server 0.178.vffe5a'
published: '2026-06-24'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T19:19:00Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-mpff-xhg4-vr45'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57300'
  - url: 'https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3759'
  - url: >-
      https://github.com/jenkinsci/mcp-server-plugin/commit/ffe5ae770f3bd7e88c99aea3018263af0b2f9cc4
  - url: >-
      https://github.com/jenkinsci/mcp-server-plugin/releases/tag/0.178.vffe5a_e770f3b_
  - url: 'https://github.com/advisories/GHSA-mpff-xhg4-vr45'
tags:
  - ghsa
  - maven
epss: 0.00281
epssPercentile: 0.18334
ingestedAt: '2026-09-25T20:17:49.424Z'
---

## Overview

Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.

This allows attackers with Item/Read permission to obtain the Pipeline script of jobs.

MCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.

## Affected packages

- `io.jenkins.plugins:mcp-server < 0.178.vffe5a`

## Remediation

Upgrade to a patched release:

- `io.jenkins.plugins:mcp-server 0.178.vffe5a`