Jenkins Customizable Header Plugin CVE-2026-84673

The attacker must hold a Jenkins account with at least 'Overall/Read' and permission to submit configuration changes to the Customizable Header Plugin - typically any authenticated user can trigger Stapler binding if the configuration endpoint is not access-controlled. The Jenkins instance must have the Customizable Header Plugin installed and active. The malicious SVG payload persists until the configuration is overwritten or the plugin is removed, and executes automatically in any authenticated user's browser on any Jenkins page load - no targeted phishing or additional user interaction beyond normal Jenkins use is required. Exploitation is limited to: (1) environments where the plugin is installed, and (2) attackers who can authenticate to Jenkins and reach the configuration binding endpoint.

The vendor CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U) reflects a low-complexity network attack requiring only authenticated access. The UI:N metric is atypical for stored XSS - normally a victim must visit the affected page (UI:R) - but is defensible here because the header renders on every Jenkins page, meaning exploitation of any authenticated visitor occurs automatically without targeted interaction. SSVC rates technical impact as total, consistent with the C:H/I:H/A:H impact metrics, meaning session hijacking, credential theft, or administrative action-in-context is possible. SSVC also rates automatable as no, which aligns with the PR:L requirement: an attacker must first obtain Jenkins credentials before writing the malicious configuration. There is no CISA KEV listing and no EPSS data provided, so real-world exploitation is unconfirmed. The realistic risk is moderate: the plugin is an optional cosmetic add-on, limiting the attack surface to environments where it is installed, but within those environments, any low-privileged account becomes a vector for platform-wide persistent XSS against all users including admins.

An attacker with a low-privileged Jenkins account (e.g., a developer with job-configuration rights) submits a crafted HTTP request via Stapler data binding to overwrite the Customizable Header Plugin's icon configuration with a malicious SVG containing an inline script that exfiltrates cookies or performs API calls. The stored payload renders in every authenticated user's browser on their next Jenkins page load, including administrators, enabling session hijacking or lateral movement to higher-privilege operations. No public proof-of-concept has been identified, but the technique is well-documented for SVG-based stored XSS and requires no specialized tooling.