The Jenkins MCP Server Plugin contains a missing permission check vulnerability affecting versions 0.177.v629fdb_2557fe and earlier. Attackers who have Item/Read permission can exploit this flaw to read Pipeline replay scripts of jobs they have access to. This issue arises because the plugin does not properly enforce permission checks on these scripts, potentially exposing sensitive pipeline configurations. There is no CVSS score or vendor advisory indicating a patch or fix at this time.

An attacker with Item/Read permission can access Pipeline replay scripts of jobs they can access, potentially exposing sensitive pipeline logic or credentials embedded in scripts. This unauthorized disclosure could aid further attacks or information gathering but does not directly allow code execution or privilege escalation based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Item/Read permissions to trusted users only to limit exposure. Monitor official Jenkins Project advisories for updates on patches or mitigations.