Jenkins Flaws Expose SAML Authentication Bypass and MCP Server Plugin Weaknesses

Jenkins users face a set of 14 distinct vulnerabilities across multiple plugins, including a critical SAML authentication bypass tracked as CVE-2025-64131 with a high CVSS score of 8.4, caused by the plugin’s lack of a replay cache in versions 4.583.vc68232f7018a and earlier. This bypass would let attackers replay SAML authentication requests to impersonate legitimate users, and Jenkins has since addressed the issue by adding replay cache protection in version 4.583.585.v22ccc1139f55.

The MCP Server plugin also contains authorization gaps (CVE-2025-64132, medium) in versions 0.84.v50ca_24ef83f2 and earlier, enabling potential privilege escalation and access to sensitive information under limited permissions. Other notable flaws include Azure CLI Plugin (CVE-2025-64140, high, 8.8) allowing shell command execution by attackers with Item/Configure permissions, JDepend Plugin with XXE injection (CVE-2025-64134), and a range of CSRF and missing permission checks across several plugins.

Organisations are urged to prioritise updates, patch affected deployments, and review plugin inventories against the impacted versions.