CVE-2025-64132: Jenkins MCP Server Auth Bypass Vulnerability

CVE-2025-64132 Overview

CVE-2025-64132 is a missing authorization vulnerability in the Jenkins MCP Server Plugin. Versions 0.84.v50ca_24ef83f2 and earlier fail to perform permission checks in multiple Model Context Protocol (MCP) tools. Authenticated attackers with limited access can trigger builds and retrieve information about job and cloud configurations they should not be able to view. The flaw is tracked under CWE-862: Missing Authorization and was disclosed in Jenkins Security Advisory SECURITY-3622.

Critical Impact
Authenticated users with minimal Jenkins permissions can enumerate job and cloud configuration details and initiate builds without proper authorization checks.

Affected Products

Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier
Jenkins controllers with the MCP Server Plugin installed and enabled
CI/CD environments exposing Jenkins MCP endpoints to authenticated users

Discovery Timeline

2025-10-29 - Jenkins publishes Security Advisory SECURITY-3622
2025-10-29 - CVE-2025-64132 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64132

Vulnerability Analysis

The Jenkins MCP Server Plugin exposes Jenkins functionality through the Model Context Protocol, an interface designed for AI agents and automation clients. The plugin registers multiple MCP tools that map to Jenkins operations including job introspection, build triggering, and cloud configuration retrieval.

Multiple MCP tool handlers in versions 0.84.v50ca_24ef83f2 and earlier do not verify the caller's Jenkins permissions before executing the requested operation. Any authenticated user with basic access to the MCP endpoint can invoke these tools regardless of the object-level permissions assigned to them in Jenkins.

Successful exploitation lets attackers enumerate sensitive pipeline metadata, read cloud provider configuration details, and start unauthorized builds. This breaks the principle of least privilege in shared Jenkins environments and can serve as a stepping stone for further compromise of connected build agents or cloud infrastructure.

Root Cause

The root cause is missing authorization enforcement inside the MCP tool implementations. The plugin relies on authentication to reach the MCP interface but omits per-operation permission checks such as Item.READ, Item.BUILD, or the equivalent cloud configuration permissions. The design gap falls squarely under CWE-862.

Attack Vector

Exploitation requires network access to the Jenkins MCP endpoint and valid low-privileged credentials. The attacker sends MCP tool invocation requests to the affected server. Because the vulnerable handlers skip permission checks, the server processes the request as if the caller were authorized. No user interaction is required, and the attack complexity is low. Refer to the Jenkins Security Advisory SECURITY-3622 and the Openwall OSS-Security post for protocol-level details.

Detection Methods for CVE-2025-64132

Indicators of Compromise

MCP tool invocations from user accounts that lack corresponding Jenkins job or cloud permissions
Unexpected build queue entries triggered through MCP endpoints outside normal pipeline schedules
Access logs showing MCP tool calls returning job or cloud configuration data to non-admin users
Correlation between MCP request bursts and reconnaissance-like enumeration of job names

Detection Strategies

Audit Jenkins access logs for requests to MCP Server Plugin endpoints and correlate the invoking user with their assigned Jenkins role
Compare build trigger events against the initiating user's Item.BUILD permission to flag unauthorized starts
Enable Jenkins audit logging plugins to record MCP tool names, arguments, and response sizes

Monitoring Recommendations

Forward Jenkins controller logs to a centralized SIEM and alert on MCP endpoint access by non-privileged users
Track the version of the Jenkins MCP Server Plugin across all controllers and alert when vulnerable versions are detected
Monitor cloud provider audit trails for build agent provisioning events that originate from unexpected Jenkins pipelines

How to Mitigate CVE-2025-64132

Immediate Actions Required

Upgrade the Jenkins MCP Server Plugin to a version later than 0.84.v50ca_24ef83f2 as directed in Jenkins Security Advisory SECURITY-3622
Inventory all Jenkins controllers to identify installations of the MCP Server Plugin
Restrict network access to the Jenkins MCP endpoint to trusted automation clients only
Review recent build history and configuration reads for activity from low-privileged accounts

Patch Information

Jenkins has released a fixed version of the MCP Server Plugin that adds permission checks to the affected MCP tools. Administrators should apply the update through the Jenkins Plugin Manager. Consult the Jenkins Security Advisory SECURITY-3622 for the specific fixed version and upgrade guidance.

Workarounds

Disable the Jenkins MCP Server Plugin until the patched version can be installed
Enforce project-based matrix authorization so that anonymous and authenticated roles have no default Item permissions
Place the Jenkins controller behind a reverse proxy that restricts MCP endpoint access to a hardened service account

bash

# Disable the plugin from the Jenkins CLI until patching
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  disable-plugin mcp-server -restart