CVE-2026-84666 in Job Configuration History Plugin
Summary
by MITRE • 09/02/2026
Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The Jenkins Job Configuration History Plugin version 1367.vc8fa_b_15101dc and earlier contains a critical security vulnerability rooted in improper validation of user-supplied input during the deserialization process via Stapler data binding. This flaw allows authenticated attackers to manipulate internal configuration parameters that control how job history is recorded and stored. Specifically, the vulnerability arises because the plugin fails to restrict or sanitize directory paths provided through HTTP request parameters bound directly to Java objects using the Stapler framework. By exploiting this mechanism, an attacker can overwrite sensitive system properties related to the location where historical configurations are persisted, effectively redirecting storage operations to a directory of their choosing on the server file system.
This capability has severe operational implications for Jenkins administrators and organizations relying on continuous integration pipelines. The ability to specify arbitrary directories enables several malicious outcomes depending on the context in which the Jenkins instance operates. Attackers can potentially write files into sensitive locations, such as web-accessible directories or paths with elevated permissions, leading to remote code execution if combined with other vulnerabilities like script console access or insecure plugin configurations. Furthermore, redirecting history storage allows for data exfiltration by forcing logs and configuration snapshots to be written to network-mounted shares accessible from external systems. It also facilitates denial of service attacks by filling up disk space in critical partitions or corrupting the integrity of audit trails necessary for compliance and forensic analysis.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) when considering potential downstream exploitation through path traversal leading to file write operations, but more accurately fits under CWE-20 Improper Input Validation due to the failure to validate directory paths provided by users. In terms of attack vectors and tactics, this behavior corresponds to MITRE ATT&CK technique T1564.008 Hidden Files and Directories if used for persistence or evasion, and potentially T1074 Data Staged if data is moved to an attacker-controlled location for exfiltration. The root cause lies in the lack of strict allow-listing for file system paths within the Stapler binding context, which trusts input that should be strictly validated against a predefined set of safe directories or absolute path constraints.
Mitigation strategies must prioritize immediate patching and access control reviews. Administrators should upgrade the Jenkins Job Configuration History Plugin to version 1367.vc8fa_b_15101dc2 or later, where this input validation flaw has been addressed by implementing stricter checks on directory paths before they are used for file system operations. In environments where immediate patching is not feasible, restricting access to the Jenkins instance through robust authentication mechanisms such as LDAP integration or OAuth providers can limit exposure to authenticated users only. Additionally, deploying a Web Application Firewall with rules that detect and block anomalous Stapler binding patterns involving path traversal sequences may provide temporary protection. Regular auditing of plugin configurations and monitoring for unusual file system activity in Jenkins data directories are recommended operational security practices to detect potential exploitation attempts early.