EUVD-2026-40091
GHSA-q6fr-25ph-fpvf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Log access is network-reachable via web UI (AV:N), requires only a low-privilege user account (PR:L), and confidentiality impact is partial (C:L) bounded to values present in accessible pipeline logs.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with access to the logs to potentially obtain sensitive values related to that step.
AnalysisAI
HCL DevOps Deploy and HCL Launch expose sensitive information in pipeline step output logs, enabling any low-privileged authenticated user with log access to read plaintext sensitive values - such as credentials, API tokens, or configuration secrets - that should be masked or redacted. All versions are potentially affected per the CPE wildcard, and the network-accessible nature (AV:N/PR:L) makes this a meaningful insider threat and lateral movement risk in enterprise CI/CD environments. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
CWE-532 (Insertion of Sensitive Information into Log File) describes the root cause: the application writes sensitive runtime values into step output logs without applying masking or sanitization. HCL DevOps Deploy (formerly IBM UrbanCode Deploy) and HCL Launch are enterprise-grade CI/CD orchestration platforms that execute deployment workflows as discrete pipeline steps; each step's stdout/stderr and metadata are captured in structured output logs accessible through the web UI. When pipeline steps reference sensitive values - environment variables, property file entries, encrypted credentials, or API keys - and those values are echoed or interpolated into log output, they become readable to any user with log-view permissions. The affected CPE (cpe:2.3:a:hclsoftware:hcl_devops_deploy_/_hcl_launch:*:*:*:*:*:*:*:*) uses a version wildcard, indicating no specific release has been confirmed safe without vendor guidance.
RemediationAI
Consult the HCL Software advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131694 to identify the specific patched version; exact fix version numbers are not available in the current input data and should not be inferred. As immediate compensating controls: restrict step output log access within HCL DevOps Deploy and HCL Launch to only those roles and users with an operational need, reducing the set of principals who can read log content - note that this may reduce visibility for developers troubleshooting deployments. Additionally, audit pipeline step configurations to ensure sensitive values are passed exclusively through the platform's secure or encrypted property mechanisms rather than as plaintext inputs that may be echoed to logs. Until a patch is applied, avoid passing raw credentials or tokens as plain environment variables in step definitions.
More in Hcl Devops Deploy Hcl Launch
View allSensitive configuration data and credentials are exposed in API responses within HCL DevOps Deploy / HCL Launch, affecti
Sensitive information disclosure in HCL DevOps Deploy / HCL Launch exposes credentials or operational data stored in app
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today