The vulnerability resides in the jobPath function within src/index.ts of the get_build_status/get_build_log/trigger_build component. An attacker can manipulate the jobPath parameter to cause the server to perform HTTP requests to arbitrary URLs, enabling server‑side request forgery. This flaw permits the execution of requests against internal or external systems that the server can reach, potentially leaking sensitive data or triggering unintended operations. The weakness is classified as CWE‑918 and is not limited to a specific environment, presenting a moderate confidentiality or integrity risk.

The affected product is hekmon8 Jenkins‑server‑mcp, version 0.1.0. No other versions or variants are listed in the CNA data.

The CVSS base score of 5.3 indicates a medium severity. EPSS and KEV data are unavailable and not listed in the CISA known exploited catalog, respectively. The vulnerability can be triggered remotely simply by making a request that includes a crafted jobPath value. Because the server forwards the request unchanged, an attacker with network access to the Jenkins‑server‑mcp instance can direct it to any reachable address, including internal services that are otherwise inaccessible.