CVE-2026-10276: Jenkins-server-mcp SSRF Vulnerability (0.1.0)

Technical summary

CVE-2026-10276 is a server-side request forgery (CWE-918) in the jobPath function within src/index.ts of Jenkins-server-mcp 0.1.0. The vulnerability affects three API endpoints: get_build_status, get_build_log, and trigger_build. By crafting a malicious jobPath parameter, an authenticated user can cause the server to make arbitrary HTTP requests on their behalf. The CVSS 3.1 score of 6.3 (MEDIUM) reflects the requirement for prior authentication (PR:L), though the attack has no network or user interaction barriers once authenticated. Public disclosure of the exploit means attack complexity is low (AC:L).

Business impact

Organizations using Jenkins-server-mcp 0.1.0 face risk of internal network reconnaissance, credential harvesting, and lateral movement if an attacker gains Jenkins credentials or if internal users abuse the feature. An attacker could probe internal services, exfiltrate data from internal APIs, or trigger actions on third-party systems masquerading as the Jenkins server. The impact is confined to confidentiality, integrity, and availability of connected systems—not direct system compromise—but can enable broader infrastructure attacks.

Affected systems

Jenkins-server-mcp version 0.1.0 is the sole confirmed affected version. This is a specialized Jenkins integration component, likely used in CI/CD pipelines or automation frameworks that rely on Jenkins APIs. Deployments are likely concentrated among development and DevOps teams. The vendors_products field is empty, indicating this is a third-party or community tool rather than a vendor-managed product.

Exploitability

The vulnerability is exploitable with a low barrier to entry: it requires only valid Jenkins credentials and standard HTTP requests. Public exploit disclosure accelerates risk; proof-of-concept code is available. However, the requirement for authentication prevents anonymous exploitation. The practical threat level depends on credential hygiene and access controls in your Jenkins environment.

Remediation

Immediate action: audit Jenkins-server-mcp 0.1.0 deployments and restrict access to trusted users only. The project maintainer has not yet released a patch despite early notification. Monitor the project repository for updates; if no patch becomes available within a reasonable timeframe, consider forking the code to apply a fix, or migrate to an alternative Jenkins integration tool. Long-term: implement network segmentation to limit the impact of SSRF attacks, and enforce strict outbound request policies on Jenkins server processes.

Patch guidance

As of the modification date (June 17, 2026), no official patch version has been confirmed released. Verify the Jenkins-server-mcp GitHub repository or package registry for any updates. If upgrading past 0.1.0, validate that the jobPath parameter is properly sanitized and validated against an allowlist of permitted Jenkins paths. If no patch is available, apply a Web Application Firewall rule to restrict outbound requests from the Jenkins server or implement reverse proxy controls to block SSRF attempts.

Detection guidance

Monitor Jenkins logs for unusual API requests to get_build_status, get_build_log, or trigger_build endpoints with suspicious jobPath parameters (e.g., containing http://, localhost, or internal IP addresses). Track outbound HTTP(S) connections from the Jenkins server to non-whitelisted destinations. Inspect authentication logs for credential access patterns that may indicate compromised accounts. Network intrusion detection systems should flag outbound requests from Jenkins to internal network ranges or sensitive external services.

Why prioritize this

Although rated MEDIUM (6.3), this vulnerability merits prompt attention because: (1) exploit code is public, lowering attack friction; (2) it enables reconnaissance and lateral movement in CI/CD environments, which are high-value targets; (3) the maintainer's non-response suggests no timely patch may be forthcoming; and (4) Jenkins credentials are often long-lived and shared across teams. Organizations should prioritize patching or alternative remediation if Jenkins-server-mcp is in active use.

Risk score, explained

CVSS 3.1 assigns a score of 6.3 (MEDIUM) based on: Network attack vector (AV:N), low attack complexity (AC:L, reflecting public exploit availability), low privileges required (PR:L, standard user credentials), no user interaction (UI:N), and impacts limited to the connected services rather than the Jenkins server itself (S:U). The score does not account for the upstream value of CI/CD environments or the potential for lateral movement, which may elevate organizational risk above the base CVSS rating.

Frequently asked questions