CVE-2026-84666 Jenkins Project CVE debrief

Who should care

Jenkins administrators, security teams, and developers using Jenkins Job Configuration History Plugin, particularly those with medium-severity concerns, should review and update the plugin to prevent potential configuration history tampering and ensure the security of their Jenkins environments.

Technical summary

Jenkins Job Configuration History Plugin version 1367.vc8fa_b_15101dc and earlier is vulnerable to a configuration history tampering issue. The plugin allows overwriting of its history recording configuration through Stapler data binding, enabling attackers to redirect history storage to an attacker-specified directory and modify history recording settings. This vulnerability impacts Jenkins administrators and users, potentially allowing unauthorized configuration changes and history modifications. To mitigate this issue, it is recommended to review and update the plugin to a version beyond 1367.vc8fa_b_15101dc, restrict access to Stapler data binding, and monitor plugin's history recording configuration and storage for suspicious activity.

Defensive priority

Medium-severity vulnerability in Jenkins Job Configuration History Plugin, requiring prompt attention to prevent potential configuration history tampering.

Recommended defensive actions

• Review and update Jenkins Job Configuration History Plugin to version beyond 1367.vc8fa_b_15101dc
• Restrict access to Stapler data binding to prevent unauthorized configuration changes
• Monitor plugin's history recording configuration and storage for suspicious activity
• Implement compensating controls to detect and prevent potential configuration tampering
• Conduct a thorough review of Jenkins Job Configuration History Plugin settings and history
• Verify plugin configuration and history recording settings are properly secured
• Track and analyze plugin updates and patches for potential security enhancements

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page indicates vulnerability in Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier, allowing attackers to redirect history storage and modify history recording settings via Stapler data binding. Limited source detail suggests verifying plugin version, reviewing configuration history, and monitoring for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.