CVE-2026-57287
Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
- Record
CVE-2026-57287- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
EUVDEUVD-2026-38767
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
- Record
EUVD-2026-38767- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8qr4-27mh-hqfr
Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "(RAW)" feature and its configuration diff views.
This allows attackers with Item/Extended Read permission (but not Item/Configure permission) to view the encrypted values of secrets, such as build trigger tokens, that Jenkins would otherwise redact from the configuration shown to them.
Job Configuration History Plugin 1367.vc8fa_b_15101dc redacts the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "(RAW)" feature and its configuration diff views to users lacking Item/Configure permission.
- Record
GHSA-8qr4-27mh-hqfr- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
NVD
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
- Record
CVE-2026-57287- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
OSVGHSA-8qr4-27mh-hqfr
Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "(RAW)" feature and its configuration diff views.
This allows attackers with Item/Extended Read permission (but not Item/Configure permission) to view the encrypted values of secrets, such as build trigger tokens, that Jenkins would otherwise redact from the configuration shown to them.
Job Configuration History Plugin 1367.vc8fa_b_15101dc redacts the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "(RAW)" feature and its configuration diff views to users lacking Item/Configure permission.
- Record
GHSA-8qr4-27mh-hqfr- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:jobConfigHistoryMaven |
before 1367 | 1367 |
org.jenkins-ci.plugins:jobConfigHistoryMaven |
before 1367, plus listed versions 1.101.111.121.131119.v509e1017356b_ Show 45 moreShow less1133.v0f5420f850531139.v888b_656ca_f6d1146.v94c2521f92131148.v8607da_ef251e1155.v28a_46a_cc06a_51156.v536a_97b_8d6491163.ve82c7c6e60a_31165.v8cc9fd1f45971166.vc9f255f45b_8a1170.v8a_c085b_dd49c1171.v04b_66d78555e1176.v1b_4290db_41a_51183.v6e2785ff75e01187.v2a_b_1ca_54d18d1191.v168c8c2b_956a1198.v4d5736c2308c1206.vc8967cc8a_2cb_1207.vd28a_54732f921212.vd4470d08ff121227.v7a_79fc4dc01f1229.v3039470161a_d1241.v07634fa_188961259.v8f24484830001264.v054b_c928547e1268.v75ce751da_9111277.vb_9a_0808495d71283.veb_dfb_00b_5ec01294.v961a_b_707546a_1296.v3459d8323cb_f1302.va_65b_ccb_fde711305.vf20a_356586b_81309.vb_4360782b_d221320.v78fdb_e432a_7f1328.vb_24fa_565cfec1330.vcb_8320ea_cdb_e1343.v4b_e819a_ecdc21352.va_201a_83893401356.ve360da_6c523a_2.02.12.1.12.102.112.122.13 |
1367 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-57287 is a medium vulnerability (CVSS 4.3) in Jenkins Job Configuration History, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. Fixed in org.jenkins-ci.plugins:jobConfigHistory 1367.
References
jenkins.io/security/advisory/2026-06-24
nvd.nist.gov/vuln/detail/CVE-2026-57287
github.com/jenkinsci/job-config-history-plugin/commit/c8fab15101dce336a8f17f10edd10c7221b860c0
Left out here: 34 versions. The JSON record has them.