HCL DevOps Deploy CVE-2026-56458

Exploitation requires that HCL DevOps Deploy is running the misconfigured CORS policy that does not limit Access-Control-Allow-Origin to trusted domains (versions 8.1-8.1.2.6 and 8.2-8.2.1.0), and - because this is a browser-mediated cross-origin attack - that a user with an active authenticated DevOps Deploy session is induced to load attacker-controlled JavaScript (e.g., visits a malicious or compromised page). Limiting factors: the target must have a valid, logged-in session in their browser at attack time; credentialed CORS abuse depends on the browser attaching session cookies to cross-origin requests; and the NVD vector's PR:N/UI:N understates this dependence on a victim's authenticated context. It does not require attacker authentication to the DevOps Deploy instance itself and it is network-reachable, but it is not a fully autonomous server-side exploit against an unattended instance.

Signals are mixed and lean moderate, not urgent. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) rates it High on confidentiality only, but PR:N/UI:N is questionable for a CORS flaw: classic exploitation requires a victim already authenticated to DevOps Deploy to visit an attacker page, which is effectively user interaction - so the real barrier is higher than the vector implies. There is also an internal conflict: the description says an attacker can 'carry out privileged actions' (a state-changing/integrity effect), yet the vector scores I:N - verify actual write impact with HCL. Corroborating low real-world priority: EPSS is 0.23% (13th percentile), it is not in CISA KEV, and SSVC returns Exploitation: none, Automatable: no, Technical Impact: partial. Net: a legitimate confidentiality issue worth patching on normal cycles, not an emergency absent evidence of exploitation.

An attacker crafts a malicious web page and lures a DevOps Deploy user who currently holds an authenticated session into visiting it. JavaScript on that page issues credentialed cross-origin requests to the DevOps Deploy API; because the CORS policy trusts the attacker's origin, the browser lets the script read the responses, exfiltrating sensitive deployment data and potentially triggering privileged operations. No public exploit code is identified at time of analysis, and attack complexity is low but hinges on the victim being logged in.