CVE-2026-84666

Awaiting Analysis Awaiting Analysis - Queue

Jenkins Job Configuration History Plugin Path Traversal Vulnerability

Publication date: 2026-09-02

Last updated on: 2026-09-04

Assigner: Jenkins Project

Description

Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-02

Last Modified

2026-09-04

Generated

2026-09-15

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-14

NVD

CVE-2026-84666

EUVD

EUVD-2026-70132

Affected Vendors & Products

Vendor	Product	Version / Range
jenkinsci	job_configuration_history_plugin	1367.vc8fa_b_15101dc

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-494	The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

Executive Summary

Jenkins Job Configuration History Plugin versions 1367.vc8fa_b_15101dc and earlier are vulnerable to improper input validation. Attackers can exploit Stapler data binding to overwrite the plugin's history recording configuration. This allows them to redirect history storage to a directory of their choice and modify settings related to history recording.

Detection Guidance

This vulnerability involves the Jenkins Job Configuration History Plugin allowing configuration changes via Stapler data binding. To detect it, inspect the plugin's configuration files for unauthorized modifications, particularly in the history storage directory settings. Check Jenkins logs for unusual activity related to plugin configuration changes.

Impact Analysis

This vulnerability could allow attackers to manipulate or delete configuration history records stored by the plugin. If exploited, it may lead to loss of audit trails, making it difficult to track changes or identify unauthorized modifications in Jenkins job configurations.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR or HIPAA by allowing unauthorized modification of configuration history, which may lead to undetected unauthorized changes or data tampering. If history recording is redirected or altered, it could obscure evidence of compliance violations or data breaches.

Mitigation Strategies

Update Jenkins Job Configuration History Plugin to a version later than 1367.vc8fa_b_15101dc to remove the vulnerability. Disable or restrict access to the plugin's configuration interface until the update is applied.

Hi! I’m here to help you understand CVE-2026-84666. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70