CVE-2026-57300: Jenkins MCP Server Plugin missing a permission check

June 24, 2026 (updated September 25, 2026)

Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build.

This allows attackers with Item/Read permission to obtain the Pipeline script of jobs.

MCP Server Plugin 0.178.vffe5a_e770f3b_ requires Item/Extended Read permission to return the replay script of a Pipeline build through the getReplayScripts MCP tool.

References

github.com/advisories/GHSA-mpff-xhg4-vr45
github.com/jenkinsci/mcp-server-plugin/commit/ffe5ae770f3bd7e88c99aea3018263af0b2f9cc4
github.com/jenkinsci/mcp-server-plugin/releases/tag/0.178.vffe5a_e770f3b_
nvd.nist.gov/vuln/detail/CVE-2026-57300
www.jenkins.io/security/advisory/2026-06-24/

Code Behaviors & Features

Detect and mitigate CVE-2026-57300 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →