CVE-2026-84666: Jenkins Project Jenkins Job Configuration History Plugin

Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days.

Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.

Affected products

• Jenkins Project Jenkins Job Configuration History Plugin: up to and including 1367.vc8fa_b_15101dc

Published 2026-09-02. Last modified 2026-09-04.