CVE-2026-84666: Vulnerability in Jenkins Project Jenkins Job Configuration History Plugin

CVE-2026-84666 affects Jenkins Job Configuration History Plugin versions 1367.vc8fa_b_15101dc and earlier. The flaw allows an attacker with limited privileges to overwrite the plugin's history recording configuration through Stapler data binding. This enables the attacker to redirect the storage location of history records to a directory they specify and alter history recording settings. The vulnerability is categorized under CWE-20 (Improper Input Validation) and CWE-494 (Download of Code Without Integrity Check). No known exploits are reported in the wild, and no official remediation or patch has been disclosed as of the publication date.

An attacker with limited privileges can manipulate the plugin's configuration to redirect history storage to an attacker-controlled location and modify how history is recorded. This could potentially allow tampering with audit trails or concealment of malicious activity related to job configuration changes. The impact is limited to confidentiality and integrity of the plugin's history data, with no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with permission to modify plugin configurations and monitor for unauthorized changes to history recording settings. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.