Job Configuration History CVE-2026-57287

Exploitation requires a valid Jenkins account with Extended Read permission explicitly granted by an administrator - this is not a default Jenkins role and must be deliberately assigned. The Jenkins Job Configuration History Plugin must be installed at version 1356.ve360da_6c523a_ or earlier. The historical configuration being viewed must contain one or more jobs or agents configured with secrets or encrypted credentials. Limiting factors include the need for authenticated access with a non-default privilege level, the absence of automation potential (SSVC: automatable=no), and the fact that the exposed data is encrypted rather than plaintext, requiring further effort to exploit beyond initial access. Jenkins instances without the plugin installed, or those where no accounts have Extended Read permission, are not exposed.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects network-accessible exploitation at low complexity, but gated behind the requirement for Extended Read permission - a non-default Jenkins role that must be explicitly granted by an administrator. This meaningfully constrains the realistic attacker pool to insiders or accounts already partially compromised. The confidentiality impact is rated Low because exposure is to encrypted rather than plaintext secrets, though the risk is not zero: encrypted values may be crackable offline or reveal credential structure. SSVC corroborates a measured posture: exploitation status is none, automatable is no, and technical impact is partial. No EPSS data was provided, no CISA KEV listing exists, and no public proof-of-concept has been identified, all of which further support treating this as a genuine but lower-priority finding. The primary risk scenario is a malicious or compromised insider leveraging historically visible encrypted secrets to escalate access.

A Jenkins user with Extended Read permission navigates to the Job Configuration History view for a job or agent whose configuration references pipeline credentials or other secrets. The plugin renders historical configuration snapshots without redacting encrypted values, displaying them where Jenkins would normally show masked placeholders. The attacker copies the exposed encrypted values for offline analysis, comparison across snapshots, or attempted decryption.