Executive brief
IBM DevOps Plan, a tool used for managing software development lifecycles, is vulnerable to a security flaw where it incorrectly handles web request headers. An attacker could exploit this to redirect users to malicious sites, steal login sessions, or manipulate the application's cache. This could lead to unauthorized access to development projects or the compromise of user accounts.
Technical details
IBM DevOps Plan versions 3.0.0 through 3.0.6 are vulnerable to Host Header Injection (CWE-644). The vulnerability exists because the application fails to properly neutralize or validate the 'Host' header in incoming HTTP requests. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request with a malicious Host header. Successful exploitation can lead to several secondary attacks, including web cache poisoning, password reset poisoning, or cross-site scripting (XSS) if the header is reflected in the response. IBM has released version 3.0.7 to address this issue.
Affected products
- IBM DevOps Plan 3.0.0 - 3.0.6
Timeline
- 2026-06-03: advisory: Initial publication by IBM
- 2026-06-03: patched: Version 3.0.7 released to address the vulnerability
- 2026-06-11: disclosed: NVD publication date