CVE-2026-21761

HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:devops_loop:2.0.0:*:*:*:*:*:*:*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) HCL DevOps Loop se ve afectado por una configuración incorrecta de Uso compartido de recursos de origen cruzado (CORS). Una configuración incorrecta de CORS puede permitir solicitudes de origen cruzado no autorizadas, exponiendo potencialmente los recursos de la aplicación a dominios no confiables.

Information

Published : 2026-07-17 17:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-21761

Mitre link : CVE-2026-21761

CVE.ORG link : CVE-2026-21761

JSON object : View

Products Affected

hcltech

devops_loop

CWE

CWE-942

Permissive Cross-domain Security Policy with Untrusted Domains

{"id": "CVE-2026-21761", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21761", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T17:53:45.450780Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCLSoftware", "product": "DevOps Loop", "versions": [{"status": "affected", "version": "2.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-17T17:17:14.893", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-942"}]}], "descriptions": [{"lang": "en", "value": "HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains."}, {"lang": "es", "value": "HCL DevOps Loop se ve afectado por una configuraci\u00f3n incorrecta de Uso compartido de recursos de origen cruzado (CORS). Una configuraci\u00f3n incorrecta de CORS puede permitir solicitudes de origen cruzado no autorizadas, exponiendo potencialmente los recursos de la aplicaci\u00f3n a dominios no confiables."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:devops_loop:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D04A534-5697-4C04-B858-F741208D371B"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}