CVE-2026-67071
MediumCVSS 6.5Summary
HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside insecure properties.
Risk Assessment
The vulnerability may lead to disclosure of sensitive data, such as passwords or keys, in logs or reports, compromising information confidentiality.
Recommendation
It is recommended to upgrade HCL DevOps Deploy / HCL Launch to a version containing the fix. Also, avoid using secure properties starting with non-ASCII characters and regularly review logs for leaks.
Other vulnerabilities in HCL DevOps Deploy / HCL Launch
See all- CVE-2026-56459Medium
A vulnerability in HCL DevOps Deploy / HCL Launch allows sensitive information disclosure. The application stores potentially sensitive data in log files that can be read by a local user.
- CVE-2026-56457Medium
A vulnerability in HCL DevOps Deploy / HCL Launch allows exposure of sensitive information in output logs. An attacker with access to the logs could potentially obtain sensitive values related to that step.
Original NVD description (English source)
HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside insecure properties.