CVE-2026-21762
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
HCL DevOps Loop is missing HTTP security headers, which reduces browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.
Risk Assessment
Missing security headers increase the risk of successful attacks against application users, potentially leading to data theft, session hijacking, or malicious content injection.
Recommendation
Configure the HCL DevOps Loop application server to include appropriate HTTP security headers (e.g., X-Frame-Options, X-Content-Type-Options, Content-Security-Policy).
Other vulnerabilities in HCL DevOps Loop
See all- CVE-2026-21764Low
The vulnerability in HCL DevOps Loop is caused by insufficient input validation, allowing special characters where they should be restricted. This may result in unintended application behavior under certain conditions.
- CVE-2026-21761Medium
CVE-2026-21761 in HCL DevOps Loop is caused by a misconfigured Cross-Origin Resource Sharing (CORS) policy. This flaw may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.
- CVE-2026-21760Medium
HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.
Original NVD description (English source)
HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS