CVE-2026-84666: Jenkins Job Configuration History Plugin vulnerability

Q: Which plugin versions are affected?

Jenkins Job Configuration History Plugin version 1367.vc8fa_b_15101dc and earlier are affected.

Published Sep 2, 2026

Updated

Jenkins Job Configuration History Plugin 1367.vc8fab15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.

Affected Software

1 affected component

Jenkins Job Configuration History Plugin<=1367.vc8fa_b_15101dc

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Jenkins Job Configuration History Plugin to a version that resolves this vulnerability.
Fixed in 1367.vc8fa_b_15101dc

Event History

Sep 2, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

Description

Frequently Asked Questions

Which plugin versions are affected?

Jenkins Job Configuration History Plugin version 1367.vc8fa_b_15101dc and earlier are affected.