Description
HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.
Published: 2026-07-17
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An improper CORS configuration in HCL DevOps Loop allows requests originating from untrusted domains to access application resources without adequate authorization. This can lead to data exposure or unverified interactions with the application, compromising confidentiality and integrity of exposed data. The weakness corresponds to CWE-942, offensive CORS misconfiguration.

Affected Systems

The vulnerability affects HCL Software’s DevOps Loop platform. No specific versions are listed, so any deployment of this product may be at risk.

Risk and Exploitability

The CVSS score of 4.2 indicates low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to craft a malicious web page or script that targets the application’s endpoints from an untrusted origin, exploiting the permissive CORS policy to read or manipulate data.

Generated by OpenCVE AI on July 30, 2026 at 23:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Configure the CORS policy to allow requests only from trusted origins and explicitly reject untrusted domains
  • Test the CORS configuration using tools or browsers to confirm that cross-origin requests from unauthorized domains are blocked and monitor logs for any unexpected cross-origin activity
  • Check the product version and consult HCL support for any updates addressing the misconfiguration

Generated by OpenCVE AI on July 30, 2026 at 23:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Hcltech
Hcltech devops Loop
Vendors & Products Hcltech
Hcltech devops Loop

Fri, 17 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Description HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.
Title CORS Misconfiguration in DevOps Loop
Weaknesses CWE-942
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Hcltech Devops Loop
cve-icon MITRE

Status: PUBLISHED

Assigner: HCL

Published:

Updated: 2026-07-17T17:53:54.150Z

Reserved: 2026-01-05T16:07:58.366Z

Link: CVE-2026-21761

cve-icon Vulnrichment

Updated: 2026-07-17T17:53:48.289Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T00:00:06Z

Weaknesses
  • CWE-942

    Permissive Cross-domain Security Policy with Untrusted Domains