Medium severity · published Oct 29, 2025
CVE-2025-64132
Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information…
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JM
Jenkins MCP Server Plugin · Jenkins Project
through 0.84.v50ca_24ef83f2 · source: vendor
MS
Mcp Server · Jenkins
before 0.86.v7d3355e6a_a_18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64132
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-64132
Vendor Advisory
https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3622
Mailing List
http://www.openwall.com/lists/oss-security/2025/10/29/2
More from Jenkins MCP Server Plugin
4.3
CVE-2026-57300
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs…