GitHub Advisoryadvisory · Maven

GHSA-8qr4-27mh-hqfr Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations

MEDIUM Published 2026-06-24 Modified 2026-09-25 Official page ↗
Aliases
CVE-2026-57287
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:jobConfigHistory
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312
Reviewed
2026-09-25

Affected packages

• Maven org.jenkins-ci.plugins:jobConfigHistory: < 1367 → fixed in 1367

Description

Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "(RAW)" feature and its configuration diff views. This allows attackers with Item/Extended Read permission (but not Item/Configure permission) to view the encrypted values of secrets, such as build trigger tokens, that Jenkins would otherwise redact from the configuration shown to them. Job Configuration History Plugin 1367.vc8fa_b_15101dc redacts the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "(RAW)" feature and its configuration diff views to users lacking Item/Configure permission.

Related

Alias · CVE (1)

  • CVE-2026-57287 Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References