8.8 High

CVE-2026-84673 Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance…

Description

Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Customizable Header Plugin	Versions not published

Do you use Jenkins Customizable Header Plugin?

Track this CVE Watch Jenkins Customizable Header Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2026-84673

Timeline

Published September 2, 2026
Last modified September 2, 2026

References

Jenkins Security Advisory 2026-09-02 www.jenkins.io

Track this CVE