The vulnerability CVE-2026-10276 affects hekmon8 Jenkins-server-mcp 0.1.0 in the jobPath function of src/index.ts, impacting the get_build_status, get_build_log, and trigger_build components. It allows an attacker to perform server-side request forgery (SSRF) remotely without privileges or user interaction. The issue was responsibly disclosed but remains unpatched as of the publication date. No official remediation or patch is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this SSRF vulnerability may allow an attacker to make unauthorized requests from the vulnerable server, potentially accessing internal resources or services that are otherwise inaccessible. The impact is rated medium with a CVSS score of 5.3, reflecting limited but notable risk. There is no indication of privilege escalation or direct code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting network access to the Jenkins-server-mcp instance and applying network-level controls to limit outbound requests from the server to trusted destinations only.