Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

Jenkins Flaws Expose SAML Authentication Bypass and MCP Server Plugin Weaknesses

Jenkins automation server users face critical security threats following the disclosure of 14 distinct vulnerabilities spanning multiple plugins.The security advisory reveals a widespread pattern of authentication bypass mechanisms, missing permission…

DBy Daniel BrooksOct 31, 20252 min read

Jenkins automation server users face critical security threats following the disclosure of 14 distinct vulnerabilities spanning multiple plugins.The security advisory reveals a widespread pattern of authentication bypass mechanisms, missing permission enforcement, and credential exposure issues that collectively put enterprise CI/CD infrastructure at serious risk.SAML Authentication Bypass Threatens User SessionsThe most critical flaw emerges from the SAML plugin vulnerability, tracked as CVE-2025-64131 with a high CVSS score of 8.4.The plugin failed to implement a replay cache in versions 4.583.vc68232f7018a and earlier, allowing attackers to intercept and replay SAML authentication requests between a user’s web browser and Jenkins.CVE IDSeverityCVSS ScoreVulnerability TypeCVE-2025-64131High8.4Replay AttackCVE-2025-64132Medium6.5Missing Permission ChecksCVE-2025-64133Medium5.4CSRFCVE-2025-64134High7.1XXE InjectionCVE-2025-64135Medium5.9Disabled Security FeatureCVE-2025-64136Medium4.3CSRFCVE-2025-64137Medium4.3Missing Permission CheckCVE-2025-64138Medium5.4CSRFCVE-2025-64139Medium5.4Missing Permission CheckCVE-2025-64140High8.8Shell Command InjectionCVE-2025-64141Medium5.4CSRFCVE-2025-64142Medium5.4Missing Permission CheckCVE-2025-64143Medium5.7Plaintext Token StorageCVE-2025-64144Medium5.7Plaintext Token StorageCVE-2025-64145Medium5.7Credential Masking IssueCVE-2025-64146Medium5.7Plaintext API Key StorageCVE-2025-64147Medium5.7API Key Masking IssueCVE-2025-64148Medium5.7Credential EnumerationCVE-2025-64149Medium6.5CSRFCVE-2025-64150Medium6.5Missing Permission CheckThis authentication bypass gives attackers complete access to user accounts without needing valid credentials or authentication details.The attack requires attackers to obtain information about the SAML authentication flow, but once captured, replayed requests authenticate them as legitimate users.Jenkins addressed this critical gap by implementing proper replay cache protection in version 4.583.585.v22ccc1139f55, making immediate updates essential for affected deployments.The MCP Server plugin carries multiple authorization failures in version 0.84.v50ca_24ef83f2 and earlier, rated as medium severity through CVE-2025-64132.The plugin fails to perform adequate permission checks across several tools, creating pathways for privilege escalation.Attackers with basic Item/Read permissions can obtain sensitive information about configured source control systems despite lacking Item/Extended Read privileges.More alarmingly, the same low-level access allows attackers to trigger new builds of protected jobs without Item/Build permissions.Additional authentication gaps permit unauthenticated users lacking Overall/Read permissions to retrieve names of configured clouds.Version 0.86.v7d3355e6a_a_18 addresses these authorization oversights through comprehensive permission validation.Azure CLI Plugin CVE-2025-64140 represents another high-severity vulnerability with a CVSS score of 8.8.The plugin fails to restrict shell command execution on the Jenkins controller, allowing attackers with Item/Configure permissions to execute arbitrary system commands.JDepend Plugin vulnerability CVE-2025-64134 introduces XML external entity (XXE) injection through outdated dependencies, potentially exposing secrets or enabling server-side request forgery attacks.Additional weaknesses include CSRF vulnerabilities across multiple plugins (Extensible Choice Parameter, Themis, and Windocks Container Manager), plaintext storage of authentication tokens and API keys in configuration files, and credential enumeration through missing permission checks. Several plugins store sensitive credentials unencrypted in config.xml files, viewable by users with Item/Extended Read permissions or file system access.Organizations running affected Jenkins deployments should prioritize patching the high-severity vulnerabilities first, particularly SAML plugin replay attacks and Azure CLI command injection flaws.Many plugins have received fixes, though several advisories note unresolved vulnerabilities without available patches at publication time.Enterprise teams should review their plugin inventory against the affected versions list and apply available security updates immediately.Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Based on reporting by GBHackers.

Advertisement
AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026