HCL DevOps Loop CVE-2026-21762

No authentication or special privilege is required to receive HTTP responses lacking security headers, as the headers are absent from all server responses by default. However, the CVSS AC:H rating indicates exploitation is not straightforward: meaningful harm requires that an attacker successfully chain this weakness with a separate technique - for clickjacking, the attacker must socially engineer a user into visiting a malicious page that embeds the Loop application in an iframe; for XSS facilitation, a separate script injection point must exist in the application. Limiting factors include: no direct code execution path from missing headers alone; no integrity or availability impact per CVSS; and the requirement for either user interaction or a secondary vulnerability to translate missing headers into actual harm. The vulnerability affects all deployments of HCL DevOps Loop regardless of configuration - no non-default setting is required to be vulnerable.

The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) classifies this as Low severity. The high attack complexity (AC:H) is the dominant risk-limiting factor: missing headers do not themselves trigger exploitation; an attacker must successfully chain a secondary attack vector - crafting a malicious page for clickjacking, finding an injected script opportunity for XSS, or leveraging MIME confusion - for any harm to materialize. Scope is unchanged (S:U), and impact is limited to confidentiality at a low level with no integrity or availability impact. No EPSS score was provided, and no KEV listing or POC exists based on available data, which is consistent with the low real-world urgency. This is a genuine but low-priority finding: it matters as a hardening gap and compliance concern (e.g., OWASP ASVS, PCI DSS web security controls) rather than as an immediately exploitable vulnerability. The absence of EPSS and version scope data limits confidence in a precise exploitation probability assessment.

An attacker wishing to perform clickjacking against HCL DevOps Loop users could host a transparent iframe embedding the application inside a malicious webpage, tricking authenticated users into performing unintended actions - feasible specifically because X-Frame-Options or a CSP frame-ancestors directive is absent. Separately, the lack of a Content-Security-Policy makes it easier to inject and execute malicious scripts if any XSS injection point exists elsewhere in the application. No public exploit code has been identified at the time of analysis.