Executive brief
The Jenkins Job Configuration History Plugin allows attackers to redirect where configuration history is stored and modify how history is recorded by exploiting unsafe data binding in the web interface. This could allow an attacker to poison historical records, prevent audit trails from functioning, or cause the plugin to store sensitive data in attacker-controlled locations, compromising operational visibility and compliance audit capabilities.
Technical details
The vulnerability is a Stapler data binding flaw in the Job Configuration History Plugin version 1367.vc8fa_b_15101dc and earlier. Attackers with access to Jenkins can submit crafted requests that exploit unsafe reflection-based form data binding to overwrite the plugin's configuration properties, including the history storage directory and recording settings. The attack requires network access to Jenkins and sufficient privileges to interact with job configuration endpoints. No authentication bypass is needed—the vulnerability exploits inadequate type validation in Stapler's form handling. An attacker can redirect history storage to arbitrary directories and disable history recording, undermining audit capabilities and potentially allowing tampering with build records.
Affected products
- Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier
Timeline
- 2026-09-02: disclosed