All vulnerabilities
CVE-2026-57287GHSA-8qr4-27mh-hqfr

org.jenkins-ci.plugins:jobConfigHistory: Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations

Jenkins Project org.jenkins-ci.plugins:jobConfigHistorymavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1367Fixed versionGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 1367org.jenkins-ci.plugins:jobConfigHistory, mavenGitHub<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>jobConfigHistory</artifactId><version>1367</version></dependency>
  • 1367org.jenkins-ci.plugins:jobConfigHistory, MavenOSV<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>jobConfigHistory</artifactId><version>1367</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "(RAW)" feature and its configuration diff views.

This allows attackers with Item/Extended Read permission (but not Item/Configure permission) to view the encrypted values of secrets, such as build trigger tokens, that Jenkins would otherwise redact from the configuration shown to them.

Job Configuration History Plugin 1367.vc8fa_b_15101dc redacts the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "(RAW)" feature and its configuration diff views to users lacking Item/Configure permission.

Text from GitHub Advisory Database

Affected versions 53

  • org.jenkins-ci.plugins:jobConfigHistory, maven< 1367GitHub
  • Jenkins Job Configuration History Pluginaffected: all versions through 1356.ve360da_6c523a_CVE List
  • org.jenkins-ci.plugins:jobConfigHistory, Mavenfrom first release, fixed in 1367OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1.10OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1.11OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1.12OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1.13OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1119.v509e1017356b_OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1133.v0f5420f85053OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1139.v888b_656ca_f6dOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1146.v94c2521f9213OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1148.v8607da_ef251eOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1155.v28a_46a_cc06a_5OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1156.v536a_97b_8d649OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1163.ve82c7c6e60a_3OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1165.v8cc9fd1f4597OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1166.vc9f255f45b_8aOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1170.v8a_c085b_dd49cOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1171.v04b_66d78555eOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1176.v1b_4290db_41a_5OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1183.v6e2785ff75e0OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1187.v2a_b_1ca_54d18dOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1191.v168c8c2b_956aOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1198.v4d5736c2308cOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1206.vc8967cc8a_2cb_OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1207.vd28a_54732f92OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1212.vd4470d08ff12OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1227.v7a_79fc4dc01fOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1229.v3039470161a_dOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1241.v07634fa_18896OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1259.v8f2448483000OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1264.v054b_c928547eOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1268.v75ce751da_911OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1277.vb_9a_0808495d7OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1283.veb_dfb_00b_5ec0OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1294.v961a_b_707546a_OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1296.v3459d8323cb_fOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1302.va_65b_ccb_fde71OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1305.vf20a_356586b_8OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1309.vb_4360782b_d22OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1320.v78fdb_e432a_7fOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1328.vb_24fa_565cfecOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1330.vcb_8320ea_cdb_eOSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1343.v4b_e819a_ecdc2OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1352.va_201a_8389340OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven1356.ve360da_6c523a_OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven2.0OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven2.1OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven2.1.1OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven2.10OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven2.11OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven2.12OSV
  • org.jenkins-ci.plugins:jobConfigHistory, Maven2.13OSV

References 5