CVE-2026-4096 identifies an HTTP header injection vulnerability in IBM DevOps Plan versions 3.0.0 through 3.0.6. The issue arises from improper neutralization of HTTP headers for scripting syntax (CWE-644), specifically due to insufficient validation of HOST headers. This vulnerability can be exploited to conduct attacks such as cross-site scripting, cache poisoning, or session hijacking against the affected system. The CVSS 3.1 base score is 6.5, indicating a medium level of severity. There is no vendor advisory or patch available at this time, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to inject malicious content via HTTP headers, potentially leading to cross-site scripting, cache poisoning, or session hijacking. This can compromise the confidentiality and integrity of user sessions and data within the affected IBM DevOps Plan instances. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation controls on HOST headers where possible and monitor for suspicious activity related to HTTP header manipulation. No official remediation or temporary fix is currently documented by IBM.