HCL Hive CVE-2026-21759

The Swagger documentation endpoint must be publicly accessible over the network without authentication, which appears to be the default or common production deployment state for affected HCL Hive versions. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R), exploitation requires no special network position beyond reaching the host on its standard HTTP/HTTPS port, no credentials, and no elevated privileges-but does require a user to actively browse to the Swagger endpoint (UI:R), preventing fully automated mass exploitation. Exploitation is strictly limited to information gathering: an attacker cannot achieve code execution, data modification, or denial of service through this vulnerability alone. The primary limiting factor for real-world risk is that HCL Hive is a niche enterprise product with a limited deployment footprint, and exploitation impact is bounded to reconnaissance assistance rather than direct compromise.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) accurately reflects the moderate, reconnaissance-only nature of this exposure. Attack complexity is low and no authentication is required, but UI:R indicates a user must actively browse to the Swagger endpoint, constraining automated mass exploitation. Confidentiality impact is rated Low-consistent with the vendor's finding that no credentials or PII were exposed, only API structural information. No EPSS data was provided in available input. The absence from CISA KEV and the lack of any identified public exploit code further reduce operational urgency. This is best characterized as a hardening gap rather than a critical vulnerability: it does not independently enable system compromise but lowers the bar for attackers already targeting the application. Organizations with HCL Hive exposed to the internet should prioritize remediation ahead of those with internal-only deployments.

An unauthenticated external attacker navigates directly to the HCL Hive Swagger UI endpoint (e.g., /swagger-ui.html) on an internet-facing deployment, browses the full OpenAPI specification to enumerate all API routes, accepted parameters, authentication schemes, and data models. Armed with this reconnaissance map, the attacker crafts targeted API requests to probe for authorization flaws, injection points, or business logic vulnerabilities in specific endpoints-dramatically reducing the time required for follow-on attack development. No public exploit code for this specific vulnerability has been identified.