Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations (CVE-2026-57287)

Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations (CVE-2026-57287) | HOL Guard CVE

Why this deserves its current priority

CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps org.jenkins-ci.plugins:jobConfigHistory (maven), org.jenkins-ci.plugins:jobConfigHistory (maven). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
org.jenkins-ci.plugins:jobConfigHistorymaven	<1367	1367
org.jenkins-ci.plugins:jobConfigHistorymaven	>=0 <1367	1367

Recommended response

Check inventory. Check lockfiles and deployed manifests for org.jenkins-ci.plugins:jobConfigHistory, org.jenkins-ci.plugins:jobConfigHistory.
Review the reported fix. Update org.jenkins-ci.plugins:jobConfigHistory to 1367; org.jenkins-ci.plugins:jobConfigHistory to 1367 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jun 24, 2026
Evidence: source:ghsa:source_dates:source-dates:record
Source modified
Sep 25, 2026
Evidence: source:ghsa:source_dates:source-dates:record
First seen by HOL
Jun 24, 2026

Sources and claim methodology

Upstream source description

Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "(RAW)" feature and its configuration diff views. This allows attackers with Item/Extended Read permission (but not Item/Configure permission) to view the encrypted values of secrets, such as build trigger tokens, that Jenkins would otherwise redact from the configuration shown to them. Job Configuration History Plugin 1367.vc8fa_b_15101dc redacts the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "(RAW)" feature and its configuration diff views to users lacking Item/Configure permission.

Quoted source text, attributed separately from HOL analysis.