The vulnerability lies in the Jenkins Job Configuration History Plugin version 1356.ve360da_6c523a_ and earlier, which fails to redact encrypted secret values when displaying historical job and agent configurations. Users granted Extended Read permission can view these ciphertexts, exposing sensitive information that is otherwise protected. Although only the encrypted form is leaked, the availability of numerous ciphertexts can aid an attacker in compromising the encryption scheme or correlating secrets across jobs, potentially leading to plaintext disclosure if cryptographic weaknesses are present.

Jenkins Project’s Job Configuration History Plugin, specifically releases up to and including 1356.ve360da_6c523a_. Any instance that uses this plugin version or older will be affected; specific downstream impacts depend on the plugin’s use in the organization’s CI/CD pipelines.

The vulnerability can be exploited by a user who has Extended Read permissions, typically an internal role with broad read access. There is no known public exploit, and the EPSS score is not available, but the risk is considered significant due to the sensitive data exposed. The plugin’s configuration history page must be accessed, which is a low‑complexity attack path for an authorized user, implying that insider threats or privilege overreach pose the main risk.