GHSA-mpff-xhg4-vr45

Suggest an improvement
Source
https://github.com/advisories/GHSA-mpff-xhg4-vr45
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mpff-xhg4-vr45/GHSA-mpff-xhg4-vr45.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mpff-xhg4-vr45
Aliases
  • CVE-2026-57300
Published
2026-06-24T15:31:48Z
Modified
2026-09-25T19:30:10Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Jenkins MCP Server Plugin missing a permission check
Details

Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.

This allows attackers with Item/Read permission to obtain the Pipeline script of jobs.

MCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.

Database specific 
{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-25T19:18:59Z",
    "nvd_published_at":  "2026-06-24T14:17:36Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / io.jenkins.plugins:mcp-server

Package

Name
io.jenkins.plugins:mcp-server
View open source insights on deps.dev
Purl
pkg:maven/io.jenkins.plugins/mcp-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.178.vffe5a

Affected versions

0.*
0.16.vc9132432728d
0.17.v941ed9da_c023
0.25.v59ca_c2d5ffc5
0.26.v4a_0d810a_7f71
0.27.v4034b_d4c4cb_5
0.33.vecd845512255
0.34.v9f214cb_76168
0.35.v03801a_87ff6d
0.37.v5d2d8c089e8b_
0.41.vdd84b_1430491
0.46.v43ff45cf7fe5
0.57.vc17d46a_5d10b_
0.77.veb_c7b_a_b_f0445
0.84.v50ca_24ef83f2
0.86.v7d3355e6a_a_18
0.88.vde1b_2e64212c
0.89.v1518513fe167
0.90.v46fb_a_0b_0e4a_3
0.92.v575c7c143c44
0.95.vb_c1a_8b_ca_216f
0.102.vf677b_eb_da_e4f
0.104.v935c459ca_ee2
0.109.vea_d3ec3083f1
0.116.v335308141e4e
0.119.v479294b_419a_7
0.130.v7837b_2a_5447e
0.138.v7c6a_22ee9160
0.148.v6b_c057f27738
0.149.ve5cd2f59de01
0.158.v8e18e64dd93c
0.166.v6a_0b_15a_7fd59
0.167.v7c50149715fa_
0.168.v13951585050d
0.172.v9db_cb_43cdb_cc
0.172.174.v9f72da_90a_710
0.174.v2747878a_eedb_
0.177.v629fdb_2557fe

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-mpff-xhg4-vr45/GHSA-mpff-xhg4-vr45.json"