CVE-2026-84673: Vulnerability in Jenkins Project Jenkins Customizable Header Plugin

CVE-2026-84673 is a stored XSS vulnerability in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier. The issue arises because the plugin allows overwriting its appearance configuration through Stapler data binding without proper sanitization. Attackers can exploit this to inject a custom SVG icon with inline JavaScript, resulting in stored cross-site scripting. This vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to inject malicious JavaScript into the plugin's configuration, which is stored and executed in the context of users viewing the plugin's UI. This can lead to compromise of user sessions, data theft, or other malicious actions impacting confidentiality, integrity, and availability of the Jenkins environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Jenkins instance to trusted users only and avoid installing or updating to the affected plugin versions. Monitor Jenkins security advisories for updates regarding this vulnerability.