EUVD-2026-36252
GHSA-p4v4-3mfq-ffjr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable with no credentials required; cache poisoning path justifies UI:N; bounded C:L/I:L because session data and content integrity are affected but full system compromise is not.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking
AnalysisAI
HTTP header injection in IBM DevOps Plan 3.0.0 through 3.0.6 allows unauthenticated remote attackers to inject arbitrary HTTP headers by supplying a malicious HOST header value that the application fails to sanitize. The vulnerability (CWE-644) can be leveraged to mount cross-site scripting attacks against users, poison intermediate caches with attacker-controlled content, or hijack authenticated sessions. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the low-complexity, no-authentication-required attack surface makes this a meaningful risk for any internet-facing deployment.
Technical ContextAI
CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax) describes a class of injection vulnerabilities where user-supplied data - here, the HTTP HOST request header - is accepted without adequate validation and subsequently reflected in HTTP responses or used in application logic. IBM DevOps Plan (CPE: cpe:2.3:a:ibm:devops_plan:*:*:*:*:*:*:*:*), a project and release planning tool in the IBM DevOps portfolio, fails to enforce strict HOST header validation. When an application trusts the HOST header for link generation, redirects, password-reset emails, or cache-key derivation, an attacker who controls that header can influence the response body or headers sent to other users. Cache poisoning is particularly dangerous in reverse-proxy or CDN-fronted deployments, where a single poisoned cache entry can affect a large population of victims without further attacker interaction.
RemediationAI
Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7275005. The advisory confirms a patch is available, though the exact fixed version number is not specified in the available data - consult the advisory directly to identify the target upgrade version. If immediate patching is not feasible, place the IBM DevOps Plan instance behind a reverse proxy or WAF configured to strip or validate the HOST header before forwarding requests to the application, ensuring it is normalized to the legitimate server hostname; note this adds operational complexity and may interfere with legitimate virtual-hosting scenarios. Additionally, restrict network access to DevOps Plan to trusted internal networks only, reducing the attack surface for unauthenticated external actors. Disable or bypass any caching layers (CDN, reverse-proxy caching) in front of DevOps Plan until patched, to eliminate the cache poisoning escalation path.
More in Devops Plan
View allBrute force credential attacks against IBM DevOps Plan 3.0.0 through 3.0.5 allow unauthenticated remote attackers to gai
IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the
Share
External POC / Exploit Code
Leaving vuln.today