What is the CVSS score of CVE-2026-21790?

CVE-2026-21790 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Traveler are affected by CVE-2026-21790?

Organizations using HCL Traveler should be aware of moderate risk from CVE-2026-21790 rated CVSS 6.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-21790?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Traveler CVE-2026-21790

EUVD-2026-15002 MEDIUM

Origin Validation Error (CWE-346)

2026-03-24 HCL

GHSA-mr94-p7f2-xw23

Authentication Bypass Traveler

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

14.5.1.0

EUVD ID Assigned

Mar 24, 2026 - 20:31 euvd

EUVD-2026-15002

Analysis Generated

Mar 24, 2026 - 20:31 vuln.today

CVE Published

Mar 24, 2026 - 20:04 nvd

MEDIUM 6.3

DescriptionCVE.org

HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks.

AnalysisAI

HCL Traveler contains a weak default HTTP header validation vulnerability (CWE-346) that allows authenticated attackers to bypass additional authentication checks and gain unauthorized access to sensitive functionality. The vulnerability affects HCL Traveler across multiple versions and requires only network access and valid credentials to exploit. While the CVSS score is moderate (6.3) and no active exploitation in the wild has been documented in KEV databases, the authentication bypass nature of this issue presents a real risk to organizations relying on Traveler for secure communications.

Technical ContextAI

This vulnerability is rooted in CWE-346 (Origin Validation Error), a class of weakness where applications fail to properly validate the origin or source of HTTP requests through header inspection. HCL Traveler, identified via CPE (cpe:2.3:a:hclsoftware:traveler:*:*:*:*:*:*:*:*), implements HTTP header-based security controls that are insufficient in their default configuration. Specifically, the application does not adequately validate headers such as Origin, Referer, or custom authentication headers, allowing an attacker with valid credentials to craft malicious requests that bypass secondary authentication mechanisms. This is a common pattern in enterprise collaboration software where additional authentication layers are expected to prevent lateral movement or privilege escalation.

RemediationAI

Organizations must upgrade HCL Traveler to the patched version specified in HCL's security advisory KB0129139 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129139). Until patches can be applied, implement compensating controls by enforcing strict HTTP header validation at the reverse proxy or WAF layer, explicitly rejecting requests with malformed or unexpected origin headers, and implementing HSTS (HTTP Strict-Transport-Security) to prevent header stripping attacks. Additionally, restrict Traveler access to trusted network segments, enforce multi-factor authentication independent of the HTTP header validation, and monitor authentication logs for anomalous authentication patterns or requests from unexpected origins.