CVE-2026-21811

LowCVSS 3.8

Published: 22/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The HCL AppScan Azure Boards Plugin may expose secrets in plaintext during pipeline execution. Depending on pipeline configuration, secrets could be visible in task outputs, debug logs, environment variable dumps, or build agent scripts despite UI masking.

Risk Assessment

Secret exposure may allow an attacker to access systems and services those secrets authorize. This may compromise the security of the CI/CD pipeline and related infrastructure.

Recommendation

Restrict access to pipeline logs and outputs and review configuration for secret exposure. Update the plugin to a patched version if available and use secure secret management.

Other vulnerabilities in HCL AppScan Azure Boards Plugin

CVE-2026-21812Low
HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.

Original NVD description (English source)

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS