EUVD-2026-45232
GHSA-hg49-v9p7-xwqr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AC:H because exploitation requires chaining with a social-engineering step; UI:R because browser attacks like clickjacking require user interaction with a malicious page.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.
AnalysisAI
HCL DevOps Loop omits critical HTTP security response headers, degrading browser-enforced protections against clickjacking, MIME-type sniffing, and cross-site scripting for all users of the application. The absence of headers such as Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options does not introduce a standalone exploit path but removes a layer of defense-in-depth that browsers rely on to block client-side attack chains. CVSS assigns a low score of 3.7 with high attack complexity, reflecting that meaningful impact requires chaining this weakness with a secondary technique; no public exploit has been identified and the vulnerability is not listed in CISA KEV.
Technical ContextAI
CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax) describes failures to set HTTP response headers that browsers use to enforce security policies. The expected headers include X-Frame-Options or the frame-ancestors CSP directive (clickjacking), X-Content-Type-Options: nosniff (MIME-sniffing), Content-Security-Policy (XSS policy enforcement), and optionally Strict-Transport-Security and Referrer-Policy. HCL DevOps Loop is a DevOps workflow and collaboration platform from HCL Software. No CPE strings were provided in the input data, so exact platform or version identification from CPE is not possible. The XSS tag suggests the missing CSP header is a primary concern, as a well-formed CSP would restrict inline script execution and unauthorized resource origins.
RemediationAI
The primary remediation is to review and apply the guidance in HCL's knowledge base article KB0132296 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296, which may include a patched release or configuration update; an exact fix version is not confirmed from available data. As a compensating control, administrators can deploy a reverse proxy (nginx, Apache HTTP Server, or a WAF) in front of HCL DevOps Loop configured to inject the missing response headers: X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, a restrictive Content-Security-Policy appropriate to the application's resource requirements, and Referrer-Policy: strict-origin-when-cross-origin. Trade-off: proxy-injected headers may duplicate or conflict with headers added by a future application-level patch, requiring configuration cleanup after upgrading. A CSP policy that is too restrictive may break application functionality and should be tested in a non-production environment before deployment.
More in Devops Loop
View allSession hijacking in IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 allows an authenticated user to impersonate a
CORS misconfiguration in HCL DevOps Loop enables authenticated network-adjacent attackers to perform unauthorized cross-
Forced browsing vulnerability in HCL DevOps Loop allows authenticated low-privileged users to access restricted administ
Insufficient input validation in HCL DevOps Loop permits special characters in fields where they should be restricted, e
Share
External POC / Exploit Code
Leaving vuln.today