Medium severity · published Jun 11, 2026
CVE-2026-4096
A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Injection attack due to improper handling of the Host header in HTTP requests.
6.1
CVSS
0.1%
EPSS
No
On KEV
Description
IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DP
DevOps Plan · IBM
3.0.0 through 3.0.6 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4096
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4096
Vendor Advisory
https://www.ibm.com/support/pages/node/7275005
More from DevOps Plan
7.5
CVE-2025-36363
IBM DevOps Plan is vulnerable to Excessive Authentication Attempts
3.3
CVE-2025-36364
IBM DevOps Plan REST APIs are vulnerable to exposure of sensitive data through request query parameters.