HCL DevOps Loop vulnerabilities

The vulnerability in HCL DevOps Loop is caused by insufficient input validation, allowing special characters where they should be restricted. This may result in unintended application behavior under certain conditions.

HCL DevOps Loop is missing HTTP security headers, which reduces browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.

CVE-2026-21761 in HCL DevOps Loop is caused by a misconfigured Cross-Origin Resource Sharing (CORS) policy. This flaw may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.