IBM DevOps Plan CVE-2026-4096

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no special conditions are required for the injection act itself - an unauthenticated attacker with network access to the IBM DevOps Plan HTTP interface can send a malformed HOST header. However, realizing the full downstream impact of XSS or session hijacking requires that the application reflect the HOST header value into a response consumed by a victim user (UI:R in practice for those sub-attacks). Cache poisoning impact is amplified when a caching proxy or CDN sits in front of the application and uses the HOST header as a cache key without normalization, which is a non-default but common deployment pattern. The vulnerability is limited to IBM DevOps Plan versions 3.0.0-3.0.6; versions outside this range are not confirmed affected. Deployments accessible only from authenticated internal networks face significantly reduced practical exposure.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately reflects the network-reachable, zero-authentication, low-complexity nature of the injection vector itself. C:L and I:L correctly capture the bounded impact: an attacker can steal session data or inject malicious content but cannot achieve full system compromise or cause denial of service directly. The UI:N rating is consistent with cache-poisoning as the primary impact path, where no victim interaction is needed to deliver poisoned content. No EPSS score was provided in the available data, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at this time. No public proof-of-concept was referenced. The real-world risk is moderate but meaningfully elevated in deployments behind shared caches or CDNs, where cache poisoning can achieve amplified reach. Organizations exposing IBM DevOps Plan to untrusted networks or the internet should treat this as a higher-urgency patch given the PR:N/AC:L vector. Internal-only deployments behind authenticated perimeter controls face reduced practical risk.

An attacker sends an HTTP request to IBM DevOps Plan with a crafted HOST header (e.g., Host: attacker.com) targeting the application's link-generation or redirect functionality; the server reflects this value unsanitized into a response (e.g., a password-reset URL or a Location header), which a cached proxy stores and serves to subsequent legitimate users. Victims loading the poisoned page execute attacker-controlled JavaScript (XSS), or are redirected to an attacker-controlled domain for credential harvesting. No proof-of-concept code is publicly referenced, but the technique is well-documented for HOST header injection vulnerabilities of this class.