EUVD-2026-46342
GHSA-c2v7-9cvc-gh5m
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable but requires authenticated low-privilege access and specific conditions (AC:H) to trigger the key-exposing response; confidentiality impact is limited to license key material with no integrity or availability effect.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security.
AnalysisAI
HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercept the relevant response to capture and misuse the exposed key material. All versions appear affected per CPE wildcard data (cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*), and the vulnerability is vendor-confirmed via HCL advisory KB0132381. No public exploit code has been identified and the issue is not listed in the CISA KEV catalog, placing overall risk at low severity consistent with the CVSS 3.1 score of 3.1.
Technical ContextAI
HCL MyCloud is an enterprise cloud management platform from HCL Software. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a class of flaw where an application returns sensitive runtime data - in this case license key material - in HTTP response payloads without masking or filtering. The CPE entry cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:* applies a wildcard across all versions, suggesting the exposure is present in the application's response-handling logic rather than a version-specific regression. License keys in enterprise software typically control feature entitlements and activation, so their exposure can enable unauthorized product activation, license cloning, or intelligence gathering about the deployment's commercial configuration.
RemediationAI
Consult the HCL vendor advisory KB0132381 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132381 for the official patch or update guidance, as no specific fixed version is confirmed in the available data. Upstream fix availability and exact patch version are not independently verifiable from current data - treat any version information from the advisory as the authoritative source. As compensating controls pending patching, restrict HCL MyCloud access to only authorized, role-appropriate users and avoid exposing the application directly to untrusted networks. Review HTTP response content for license key material and, where application architecture permits, mask or omit such values from client-facing responses. Rotate any exposed license keys after patching to limit residual risk from keys that may have already been captured.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing at
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessio
TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication token
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-110
Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or applicat
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today