Database/Control plane, storage & DevOps
Jenkins Customizable Header Plugin: SVG icon config injection yields stored XSS on every page
Impact
The plugin's appearance configuration can be overwritten through Stapler data binding, letting an attacker set a custom SVG icon containing inline JavaScript. Because the header renders on every Jenkins page, the payload executes in the browser of every user including administrators, making credential and session theft on the build controller straightforward. A Jenkins administrator session is the key to the pipelines that build and publish what runs on the GPU nodes. Affects Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier; only clusters that actually installed this plugin are exposed.
Who can reach it
Authenticated low-privileged Jenkins user who can reach the controller over the network and submit the data-bound configuration. Administrator victims are hit passively when they load any Jenkins page.
What to do
The 2026-09-02 advisory (SECURITY-4104) does not list a fixed release in the record here; if no fixed version is available, uninstall or disable the Customizable Header Plugin and reset its appearance configuration. Either way it is a plugin change plus a controller restart - no GPU node maintenance.
References
Related entries
- Airflow Kafka provider: connection editor gains code execution inside the scheduler processCVE-2026-86792 · Apache Airflow Apache Kafka provider (connection `extra` callable resolution)High
- Windows Server for NFS: out-of-bounds read allows remote code execution against the NFS serverCVE-2026-88115 · Windows Server for NFS (Server for NFS role, Windows Server 2012-2016)High
- ansible-core: symlink chain in a collection tarball writes files outside the install directoryCVE-2026-89091 · ansible-core (ansible-galaxy collection install archive extractor)High
- Oracle ZFS Storage Appliance Kit: low-privileged HTTP request takes over the storage controllerCVE-2026-91527 · Oracle ZFS Storage Appliance Kit 8.8 (Core)High
- Jenkins Script Security Plugin: four Groovy sandbox escapes give code execution on the controllerCVE-2026-92122 · Jenkins Script Security Plugin (Groovy sandbox)High
- Jenkins Robot Framework Plugin: archive path escapes the build directory, allowing arbitrary file writeCVE-2026-92137 · Jenkins Robot Framework Plugin (report archive directory)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.