HCL DevOps Deploy CVE-2026-56460

Exploitation requires a valid authenticated session with at minimum low-privilege access to the HCL DevOps Deploy / HCL Launch platform (confirmed by CVSS PR:L). No administrative role or elevated permission is needed - any user with API access can trigger the disclosure through standard requests. What limits exploitation: unauthenticated external attackers cannot exploit this directly, meaning the attacker must first possess or obtain platform credentials; network exposure of the HCL DevOps Deploy interface further limits external reach if the service is not internet-accessible. The specific API endpoints or request parameters that trigger the sensitive disclosure are not detailed in available public data.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5, reflecting low-complexity network exploitation by any authenticated user with no interaction required. The high confidentiality impact (C:H) is significant in context: secrets exposed by a CI/CD platform typically grant access to downstream infrastructure far beyond the tool itself, even though scope is formally unchanged (S:U). No EPSS score was provided, limiting quantitative exploitation probability assessment. The vulnerability is not in CISA KEV and no public exploit code exists. Despite these moderating factors, the attack complexity is genuinely low - exploitation requires only a valid API call - and the broad affected version range across four major branches suggests large unpatched enterprise exposure. The risk profile resembles targeted credential harvesting rather than opportunistic mass exploitation, consistent with the tool's enterprise-only deployment footprint.

An attacker with valid low-privilege credentials - for example, a developer account or contractor with basic deployment access - authenticates to the HCL DevOps Deploy API and issues standard API requests to configuration or environment endpoints. The API responses include sensitive values such as stored credentials or API tokens for connected infrastructure. The attacker then uses these extracted secrets to authenticate directly to downstream systems (cloud environments, databases, or network infrastructure) as a higher-privileged identity, bypassing the CI/CD tool entirely for subsequent access.