CVE-2026-56460
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability in HCL DevOps Deploy / HCL Launch allows authenticated users to access sensitive configurations and secrets in API responses, which could be leveraged for further attacks against the system.
Risk Assessment
The risk involves exposure of confidential data such as passwords or API keys, potentially leading to privilege escalation or system compromise by an attacker.
Recommendation
It is recommended to immediately update HCL DevOps Deploy / HCL Launch to the latest patched version and restrict API access to trusted users only.
Other vulnerabilities in HCL DevOps Deploy
See all- CVE-2026-56458Medium
The vulnerability in HCL DevOps Deploy stems from improper CORS configuration that does not restrict domains to trusted ones. This allows an attacker to perform privileged actions and retrieve sensitive information.
- CVE-2025-62327Medium
In HCL DevOps Deploy versions 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.
Original NVD description (English source)
HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS