CVE-2025-62327
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In HCL DevOps Deploy versions 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.
Risk Assessment
The risk involves potential disclosure of sensitive credentials, which could lead to unauthorized access to systems or external services.
Recommendation
Upgrade HCL DevOps Deploy to a version newer than 8.1.2.3 and restrict LLM configuration privileges to trusted users only.
Other vulnerabilities in HCL DevOps Deploy
See all- CVE-2026-56460Medium
A vulnerability in HCL DevOps Deploy / HCL Launch allows authenticated users to access sensitive configurations and secrets in API responses, which could be leveraged for further attacks against the system.
- CVE-2026-56458Medium
The vulnerability in HCL DevOps Deploy stems from improper CORS configuration that does not restrict domains to trusted ones. This allows an attacker to perform privileged actions and retrieve sensitive information.
Original NVD description (English source)
In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS