HCL DevOps Deploy CVE-2026-56459

Local access to the operating system hosting HCL DevOps Deploy / HCL Launch is required; remote exploitation is not possible given AV:L. Critically, the CVSS PR:N metric indicates that no special OS privileges or application-level authentication are needed to read the log files - any local user with shell access to the host appears sufficient, which implies the log directory or files carry world-readable or group-readable permissions accessible beyond the service account. Exploitation is limited to hosts running affected versions (7.3 through 7.3.2.18, 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, 8.2 through 8.2.1.0). There is no required user interaction and no dependency on a specific application configuration beyond the product being installed and having generated log output containing sensitive data.

The CVSS 3.1 base score of 6.2 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N correctly captures the local-only attack surface but flags a notable anomaly: PR:N (no privileges required) combined with AV:L implies the log files are world-readable by any authenticated OS user, not just privileged accounts. This significantly raises practical risk in environments where multiple users or service accounts share a host. There is no KEV listing and no publicly available exploit code identified, keeping opportunistic exploitation risk low. However, the high confidentiality impact (C:H) is credible for a DevOps platform that handles deployment credentials, environment secrets, and integration tokens. Real-world risk is elevated in shared infrastructure or containerized environments where process namespaces or volume mounts expose log paths to co-located workloads. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified.

A local OS user on the server hosting HCL DevOps Deploy - such as a developer, contractor, or compromised service account - reads application log files from the default log directory without requiring elevated privileges. The logs contain plaintext credentials, deployment tokens, or environment secrets written during pipeline execution, which the attacker then uses to pivot into downstream systems or cloud environments managed by the DevOps platform. No public exploit code is required; standard OS file-reading tools suffice given the permissive log file access indicated by PR:N in the CVSS vector.