EUVD-2026-38767
GHSA-8qr4-27mh-hqfr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Extended Read is a low-privilege but non-default Jenkins role; encrypted (not plaintext) secret exposure justifies C:L; no integrity or availability impact applies.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.
AnalysisAI
Jenkins Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier exposes encrypted secret values to any Jenkins user holding Extended Read permission by failing to apply Jenkins' standard secret redaction when rendering historical job and agent configurations. Encrypted credential values that Jenkins would normally mask are displayed in full within the plugin's history view, potentially enabling offline analysis of those values. No public exploit or active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact.
Technical ContextAI
The Jenkins Job Configuration History Plugin is an optional add-on that tracks and presents a versioned history of changes to job and agent configurations within a Jenkins CI/CD environment. Jenkins core applies redaction logic when displaying configuration fields containing secrets or encrypted credentials, replacing their values with masked placeholders. CWE-312 (Cleartext Storage of Sensitive Information) identifies the root cause class: the plugin bypasses or omits this redaction when reconstructing historical snapshots for display, causing encrypted credential values - which Jenkins would normally hide - to be rendered visibly. While the values are encrypted rather than plaintext, they remain sensitive: encrypted secrets may be subject to offline decryption attempts or comparative analysis. The affected product is identified by CPE cpe:2.3:a:jenkins_project:jenkins_job_configuration_history_plugin:*:*:*:*:*:*:*:*, covering all releases through 1356.ve360da_6c523a_.
RemediationAI
Upgrade the Jenkins Job Configuration History Plugin to a version beyond 1356.ve360da_6c523a_ per the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3742. The exact patched release version is not independently confirmed in the available data - consult the advisory directly for the specific fixed version. As an immediate compensating control, administrators should audit all accounts holding Extended Read permission and revoke it from any principal that does not strictly require it, since this permission is a hard prerequisite for exploitation; revocation will fully prevent the exposure for unentitled users with the trade-off of reducing their ability to inspect configurations. Additionally, administrators should review whether any historical configuration entries have already exposed encrypted values to Extended Read users and assess whether credential rotation is warranted for any high-value secrets present in those histories.
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today