{"cve":"CVE-2026-57287","nvd":{"published":"2026-06-24T14:17:34.943","modified":"2026-10-25T22:10:00.150","status":"Analyzed","description":"Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations, allowing attackers with Extended Read permission to view encrypted secret values that would otherwise be redacted.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-312"],"references":["https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3742"],"products":["jenkins:job_configuration_history"],"source":"nvd","synced_at":"2026-10-25T23:44:33.281319194+00:00"},"epss":{"cve":"CVE-2026-57287","score":0.00195,"percentile":0.09133,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-8qr4-27mh-hqfr","url":"https://osv.dev/vulnerability/GHSA-8qr4-27mh-hqfr","summary":"Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations","modified":"2026-09-25T18:15:04.449372480Z","packages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:jobConfigHistory","purl":"pkg:maven/org.jenkins-ci.plugins/jobConfigHistory","ranges":["<1367"],"fixed":["1367"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}