CVE-2026-84666

MediumCVSS 5.4

Published: 02/09/2026(UTC)Updated: 04/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

Jenkins Job Configuration History Plugin version 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.

Risk Assessment

Risk of compromising job configuration history integrity and potential hiding or altering audit trails.

Recommendation

Update the Jenkins Job Configuration History Plugin to a version newer than 1367.vc8fa_b_15101dc that includes the fix.

Other vulnerabilities in Jenkins Job Configuration History Plugin

CVE-2026-57287Medium
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.

Original NVD description (English source)

Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS