CVE-2026-21762

HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:devops_loop:2.0.0:*:*:*:*:*:*:*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) HCL DevOps Loop se ve afectado por la ausencia de encabezados de seguridad HTTP. La ausencia de encabezados de seguridad puede reducir las protecciones del navegador contra ataques web comunes como clickjacking, sniffing de tipo MIME y cross-site scripting.

Information

Published : 2026-07-17 17:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-21762

Mitre link : CVE-2026-21762

CVE.ORG link : CVE-2026-21762

JSON object : View

Products Affected

hcltech

devops_loop

CWE

CWE-644

Improper Neutralization of HTTP Headers for Scripting Syntax

{"id": "CVE-2026-21762", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21762", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T17:53:17.227497Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCLSoftware", "product": "DevOps Loop", "versions": [{"status": "affected", "version": "2.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-17T17:17:15.010", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-644"}]}], "descriptions": [{"lang": "en", "value": "HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting."}, {"lang": "es", "value": "HCL DevOps Loop se ve afectado por la ausencia de encabezados de seguridad HTTP. La ausencia de encabezados de seguridad puede reducir las protecciones del navegador contra ataques web comunes como clickjacking, sniffing de tipo MIME y cross-site scripting."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:devops_loop:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D04A534-5697-4C04-B858-F741208D371B"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}