CVE-2026-21761
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
CVE-2026-21761 in HCL DevOps Loop is caused by a misconfigured Cross-Origin Resource Sharing (CORS) policy. This flaw may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.
Risk Assessment
The risk involves potential leakage of sensitive data or unauthorized operations from an external domain, which could compromise system confidentiality and integrity.
Recommendation
It is recommended to immediately update HCL DevOps Loop to the latest patched version and review the CORS configuration to restrict allowed origin domains.
Other vulnerabilities in HCL DevOps Loop
See all- CVE-2026-21764Low
The vulnerability in HCL DevOps Loop is caused by insufficient input validation, allowing special characters where they should be restricted. This may result in unintended application behavior under certain conditions.
- CVE-2026-21762Low
HCL DevOps Loop is missing HTTP security headers, which reduces browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.
- CVE-2026-21760Medium
HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.
Original NVD description (English source)
HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.