CVE-2025-64132CWE-862broken-access-control

CVE-2025-64132

Medium · published October 29, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information about job and cloud configuration they should not be able to access.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-10-29T18:15Z
Affected products (1)
ProductVersionsFixed in
jenkins/mcp_server< 0.86.v7d3355e6a_a_180.86.v7d3355e6a_a_18
References (2)
https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3622 · [email protected]http://www.openwall.com/lists/oss-security/2025/10/29/2 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 29 OCT 13:29Z
    Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and…
    cvelistv5