CVE-2026-84666: Jenkins Path Traversal Vulnerability

CVE-2026-84666 Overview

CVE-2026-84666 affects the Jenkins Job Configuration History Plugin version 1367.vc8fa_b_15101dc and earlier. The plugin exposes its history recording configuration to Stapler data binding without adequate access control. Attackers can overwrite the configuration to redirect history storage to an attacker-controlled directory and modify history recording settings. This weakness affects Jenkins environments that rely on the plugin to audit job configuration changes.

Critical Impact
Attackers can redirect Jenkins job configuration history to arbitrary directories and tamper with history recording settings, undermining change auditing and integrity of configuration records.

Affected Products

Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier
Jenkins controllers running the affected plugin versions
Environments relying on the plugin for job configuration audit trails

Discovery Timeline

2026-09-02 - Jenkins publishes Security Advisory SECURITY-4098
2026-09-02 - CVE-2026-84666 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84666

Vulnerability Analysis

The Jenkins Job Configuration History Plugin records changes to job configurations for auditing. The affected versions expose internal configuration fields through Stapler, the web framework used by Jenkins to bind HTTP request parameters to Java objects. Attackers can submit crafted requests that overwrite the plugin's history recording configuration. This includes changing the target directory where history entries are written and altering recording behavior.

Because the plugin does not restrict which fields Stapler may bind, sensitive configuration state becomes writable through normal HTTP handlers. An attacker who can reach the affected endpoints can redirect history output to a directory of their choice. This breaks the audit trail and can be combined with follow-on techniques to hide malicious job modifications.

Root Cause

The root cause is improper access control on data-bound fields exposed through Stapler. The plugin does not validate whether the caller is authorized to modify history recording configuration during request binding. This maps to Broken Access Control on framework-bound properties.

Attack Vector

An attacker sends an HTTP request to the Jenkins controller that binds attacker-supplied values to the plugin's history configuration. The request modifies the storage directory and recording settings. No verified public exploit is available at this time. Refer to the Jenkins Security Advisory SECURITY-4098 for authoritative technical detail.

No verified proof-of-concept code is publicly available for CVE-2026-84666.
Refer to the Jenkins Security Advisory linked above for technical details.

Detection Methods for CVE-2026-84666

Indicators of Compromise

History records written to unexpected filesystem paths outside the plugin's configured default directory.
Unexpected changes to the Job Configuration History Plugin settings within JENKINS_HOME.
HTTP POST requests to Jenkins that include parameters targeting the plugin's history configuration fields.

Detection Strategies

Audit Jenkins access logs for requests to Job Configuration History Plugin endpoints containing configuration binding parameters.
Compare current plugin configuration against a known-good baseline to identify unauthorized modification.
Alert on writes by the Jenkins process to filesystem paths outside the expected history storage directory.

Monitoring Recommendations

Forward Jenkins controller access and audit logs to a centralized log platform for correlation.
Monitor filesystem changes under JENKINS_HOME and any custom history storage directories.
Track plugin version inventory across all Jenkins controllers to identify unpatched instances.

How to Mitigate CVE-2026-84666

Immediate Actions Required

Upgrade the Jenkins Job Configuration History Plugin to the fixed release identified in Jenkins Security Advisory SECURITY-4098.
Restrict access to Jenkins controllers so only authenticated, authorized users can reach configuration endpoints.
Review current plugin configuration and reset the history storage directory to a trusted path.

Patch Information

Jenkins has published SECURITY-4098 addressing this issue. Administrators should upgrade the Job Configuration History Plugin to the fixed version documented in the advisory. Verify the plugin version through the Jenkins Plugin Manager after upgrade.

Workarounds

Limit Overall/Administer and Job/Configure permissions to trusted users until patching is complete.
Place the Jenkins controller behind network access controls that block untrusted HTTP clients.
Disable the Job Configuration History Plugin if it is not required in the environment.

bash

# Verify installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ list-plugins | grep jobConfigHistory