CVE-2026-84666

Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.

  • Published Sep 2, 2026
  • CVSS 5.4 medium
  • 0.1% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-84666 at the National Vulnerability Database