CVE-2026-84673: Jenkins Customizable Header Plugin XSS

CVE-2026-84673 Overview

CVE-2026-84673 is a stored cross-site scripting (XSS) vulnerability in the Jenkins Customizable Header Plugin, versions 295.v2544b_ca_19b_97 and earlier. The flaw allows attackers to overwrite the plugin's appearance configuration through Stapler data binding. An attacker with authenticated access can configure a custom Scalable Vector Graphics (SVG) icon containing inline JavaScript. When rendered in the Jenkins UI, the JavaScript executes in the browser context of any user who views the affected page. The issue is tracked under CWE-79 and disclosed in the Jenkins Security Advisory 2026-09-02.

Critical Impact
Authenticated attackers can inject persistent JavaScript into the Jenkins interface, enabling session hijacking, credential theft, and pivoting to code execution on Jenkins controllers.

Affected Products

Jenkins Customizable Header Plugin version 295.v2544b_ca_19b_97
Jenkins Customizable Header Plugin earlier versions
Jenkins controllers with the plugin installed and enabled

Discovery Timeline

2026-09-02 - Jenkins Security Advisory SECURITY-4104 published
2026-09-02 - CVE-2026-84673 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84673

Vulnerability Analysis

The Customizable Header Plugin extends the Jenkins user interface to allow administrators to change appearance elements such as icons and branding. The plugin exposes its appearance configuration through Stapler, the web framework used by Jenkins to bind HTTP request parameters to Java objects. Missing permission checks on the configuration endpoint allow any authenticated user to overwrite these settings. An attacker supplies a custom SVG icon that contains inline <script> elements or JavaScript event handlers. Jenkins serves the SVG without sanitization, and the browser executes the embedded script whenever the icon is rendered.

Root Cause

The root cause is a combination of two issues. First, the plugin's Stapler-bound setters do not enforce administrator-level permissions before persisting configuration changes. Second, the plugin accepts user-supplied SVG content and renders it inline without stripping executable script contexts. SVG files support the same JavaScript execution surface as HTML, so unsanitized SVG uploads produce persistent XSS.

Attack Vector

An attacker authenticated to Jenkins with low privileges sends a crafted HTTP POST request that overwrites the plugin's appearance configuration. The payload includes a data URI or inline SVG containing JavaScript. Every subsequent user who loads a page displaying the icon executes the attacker-controlled script under the Jenkins origin. Because Jenkins administrators regularly access the interface, the attacker can escalate to full controller compromise by chaining the XSS with Groovy script console access or by exfiltrating session cookies and API tokens. See the Jenkins Security Advisory for technical details.

Detection Methods for CVE-2026-84673

Indicators of Compromise

Unexpected changes to the Customizable Header Plugin appearance configuration in $JENKINS_HOME/config.xml or plugin-specific configuration files
SVG assets served by Jenkins containing <script> tags, on* event handlers, or javascript: URIs
Outbound HTTP requests from administrator browsers to attacker-controlled domains following Jenkins UI access
Audit log entries showing non-administrator users invoking configuration setters on the plugin

Detection Strategies

Inspect the Jenkins audit log for POST requests to plugin configuration endpoints from accounts without administrator roles
Scan stored plugin configuration for SVG payloads containing JavaScript keywords such as script, onload, or onerror
Monitor browser telemetry from workstations used to administer Jenkins for anomalous script execution originating from the Jenkins origin

Monitoring Recommendations

Enable and forward Jenkins access logs to a centralized analytics platform for query and correlation
Alert on configuration file modifications for the Customizable Header Plugin outside of change windows
Track authentication events and API token usage for administrator accounts that access Jenkins after UI rendering of a modified icon

How to Mitigate CVE-2026-84673

Immediate Actions Required

Upgrade the Jenkins Customizable Header Plugin to a version later than 295.v2544b_ca_19b_97 once released by the maintainers
Disable the Customizable Header Plugin until a fixed release is installed if the plugin is not required
Restrict Jenkins user accounts to the minimum required permissions and audit existing role assignments
Rotate Jenkins API tokens and administrator credentials if unauthorized configuration changes are detected

Patch Information

The Jenkins Security Advisory 2026-09-02 tracks the fix under SECURITY-4104. Administrators should consult the advisory for the fixed plugin version and upgrade Jenkins using the Plugin Manager or by replacing the plugin .hpi file and restarting the controller.

Workarounds

Remove the plugin from the Jenkins controller if a fixed version is not yet available
Enforce a Content Security Policy that restricts inline script execution for Jenkins resources where feasible
Limit network access to the Jenkins web interface to trusted administrative networks using a reverse proxy or firewall rules

bash

# Configuration example: disable the plugin via the Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth admin:$JENKINS_API_TOKEN \
  disable-plugin customizable-header -restart