CVE-2026-56458
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The vulnerability in HCL DevOps Deploy stems from improper CORS configuration that does not restrict domains to trusted ones. This allows an attacker to perform privileged actions and retrieve sensitive information.
Risk Assessment
The organization is at risk of data theft and unauthorized operations within the system, potentially leading to breaches of data confidentiality and integrity.
Recommendation
Update HCL DevOps Deploy to the latest version and configure the allowed domains list in CORS to restrict access only to trusted origins.
Other vulnerabilities in HCL DevOps Deploy
See all- CVE-2026-56460Medium
A vulnerability in HCL DevOps Deploy / HCL Launch allows authenticated users to access sensitive configurations and secrets in API responses, which could be leveraged for further attacks against the system.
- CVE-2025-62327Medium
In HCL DevOps Deploy versions 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.
Original NVD description (English source)
HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS