CVE-2026-84673: Jenkins Project Jenkins Customizable Header Plugin

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.

Affected products

• Jenkins Project Jenkins Customizable Header Plugin: up to and including 295.v2544b_ca_19b_97

Published 2026-09-02. Last modified 2026-09-03.