Medium severity · published Jun 24, 2026
CVE-2026-57287
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations,…
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JJ
Jenkins Job Configuration History Plugin · Jenkins Project
through 1356.ve360da_6c523a_ · source: vendor
JC
Job Configuration History · Jenkins
through 1356.ve360da_6c523a · source: NVD
Affected product
JJ
Jenkins Job Configuration History Plugin
Jenkins Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57287
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57287
Vendor Advisory
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3742
More from Jenkins Job Configuration History Plugin
5.4
CVE-2026-84666
Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing…