Jenkins MCP Server Plugin Missing Permission Checks Vulnerability

A vulnerability exists in the Jenkins MCP Server Plugin in versions through 0.84.v50ca_24ef83f2, where permission checks are not properly enforced in several MCP tools. This oversight allows attackers to trigger builds and access job and cloud configuration information that should be restricted.

Impact

Exploitation of this vulnerability could lead to unauthorized access to job and cloud configuration details, as well as the ability to trigger builds on behalf of the user.

Remediation

Users of the MCP Server Plugin should update to version 0.86.v7d3355e6a_a_18, which includes the necessary permission checks for the affected MCP tools.