Database/Control plane, storage & DevOps

Jenkins Job Configuration History Plugin: attackers redirect history storage to a directory of their choosing

CVSS 5.4CVE-2026-84666Control plane, storage & DevOpscurated

Impact

The plugin's history recording configuration is reachable through Stapler data binding without the permission check that should guard it, so a low-privilege user can point history storage at an arbitrary directory and change what gets recorded. The direct effect is on the controller filesystem, where the plugin will then write; the more useful effect for an attacker is that the audit trail of job configuration changes can be diverted or turned off. On a fleet where Jenkins is what pushes images and submits jobs to the GPU cluster, that change log is often the only record of who altered a pipeline, so losing it quietly makes a later tampering step much harder to reconstruct. Scored 5.4 with low confidentiality and integrity impact, which reflects the config-write rather than any direct code execution.

Who can reach it

Any authenticated Jenkins user with a low-privilege account on the controller, reaching the controller's web interface. No administrator rights are needed, which is the point of the finding.

What to do

Affected versions are 1367.vc8fa_b_15101dc and earlier; the record does not state a fixed release, so check the Jenkins advisory of 2026-09-02 (SECURITY-4098) before planning, since Jenkins publishes some plugin issues with no fix available. If a fix exists, updating a plugin means installing it and restarting the controller, which kills in-flight builds unless you quiet-down first, so pair it with your next controller window. If no fix is available, the mitigation is to remove the plugin or tighten who holds an account on the controller at all.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-84666 https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4098

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.