CVE-2026-84673

The Jenkins Customizable Header Plugin, versions 295.v2544b_ca_19b_97 and earlier, allows the plugin's appearance configuration to be overwritten through Stapler data binding. An attacker with low-privileged access to the Jenkins controller (the CVSS 3.1 vector scores required privileges as low, over the network) can set a custom SVG icon containing inline JavaScript, which the plugin stores and renders in the Jenkins UI. This is a stored cross-site scripting (XSS) vulnerability (CWE-79): the injected JavaScript executes in other users' browsers when they load Jenkins pages, potentially allowing the attacker to perform actions in their sessions or access data visible to them. Only Jenkins installations with the Customizable Header Plugin installed are affected; controllers without this plugin are not. No public proof of concept or confirmed exploitation is known; the issue is not listed in CISA's KEV catalog, and EPSS currently estimates a 0.3% probability of exploitation within 30 days.

What to do: Upgrade the Customizable Header Plugin to the newest available release (anything later than 295.v2544b_ca_19b_97) via the Jenkins plugin manager; the Jenkins security advisory for this CVE will name the fixed version. Until patched, review the plugin's appearance configuration for unexpected custom SVG icons and limit which users can modify the plugin's appearance settings. Given no known public PoC or in-the-wild exploitation, routine patching cadence is reasonable for lower-risk environments, but prioritize controllers exposed to untrusted or low-privilege users.