EUVD-2026-108085
GHSA-c8p7-j7hh-mm95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Azure DevOps pipeline
-
ExploitRun plugin in leaky configuration
-
ExecutionRead plaintext secrets from logs/env dumps
-
ImpactReuse harvested credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Exploitation Conditions | Exploitation requires an Azure DevOps pipeline that uses the HCL AppScan Azure Boards Plugin AND is configured such that secrets flow into task outputs, debug/verbose logs, environment-variable dumps, or build-agent scripts; it also requires an actor with sufficient privileges to configure or run that pipeline and/or to read its execution output. Limiting factors: secrets are masked in the Azure DevOps UI, so leakage only occurs in specific (non-default) pipeline configurations and only via execution artifacts; the PR:H metric indicates privileged pipeline access is needed, and no anonymous or unauthenticated path is described. |
| Impact | All available signals point to a low-priority issue rather than an urgent one. The input CVSS is 3.8 (Low) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, meaning exploitation requires high privileges (PR:H) and yields only limited confidentiality and integrity impact. The vuln.today Decision label is 'monitor', KEV status is not present (so no confirmed active exploitation), no POC or exploit reference is supplied, and no EPSS score is provided - so there is no probabilistic exploitation signal to weigh. There are no conflicting high-severity indicators: a low CVSS, a 'monitor' decision, and the absence of KEV/POC are mutually consistent and all indicate low real-world urgency. One internal tension worth flagging: the vendor assigned I:L (integrity impact), but the described flaw is pure information disclosure of plaintext secrets (CWE-522), where a confidentiality-only impact would be more expected - the integrity rating is not explained by the description and should be verified with HCL. Likewise, the vector states AV:N, yet realistic exploitation depends on having access to Azure DevOps pipeline configuration and/or execution logs; treat AV:N as reflecting the network-reachable Azure DevOps surface rather than anonymous remote attack. |
| Exploit ScenarioDerived | A user with privileges to configure or run an Azure DevOps pipeline that uses the HCL AppScan Azure Boards Plugin arranges (or encounters) a pipeline configuration in which secrets are echoed into task outputs, debug logs, environment-variable dumps, or build-agent scripts. Although the Azure DevOps UI masks these secrets, they appear in plaintext in those execution artifacts, letting anyone able to read the pipeline output harvest them. No public exploit identified at time of analysis, and the precise trigger (which configurations leak) is not fully detailed in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Secrets used by the HCL AppScan Azure Boards Plugin can be disclosed in plaintext during Azure DevOps pipeline execution when pipelines are configured to emit task outputs, debug or verbose logs, environment-variable dumps, or build-agent scripts. The issue affects pipelines that use the plugin and requires an authenticated actor with sufficient pipeline privileges to configure or run the pipeline and/or read its output. No public exploit was identified at time of analysis, and available signals support a low-priority monitor decision because exposure depends on specific non-default pipeline configurations.
RemediationAI
No vendor-released patch version is identified in the provided data; consult HCL advisory KB0134539 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134539 for fixed releases and vendor guidance. Until a fix is confirmed, inventory Azure DevOps pipelines that use the HCL AppScan Azure Boards Plugin and remove or suppress secret-bearing task outputs, debug or verbose logging, environment-variable dumps, and build-agent script output; restrict who can edit or run those pipelines and who can read their logs. These controls reduce exposure but do not replace a vendor fix, and reducing logging or output detail can limit troubleshooting visibility.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-522, insufficiently protected credentials: secrets remain accessible in pipeline execution artifacts even though they are masked in the Azure DevOps user interface. The provided evidence identifies task outputs, debug or verbose logs, environment-variable dumps, and build-agent scripts as possible leakage channels when a pipeline using the HCL AppScan Azure Boards Plugin emits them. The exact code path and whether all plugin tasks are affected are not described in the available sources. The independent assessment rates the issue as AC:H/PR:L with high confidentiality impact, indicating that an authenticated actor with pipeline privileges is required and that secret exposure can be significant when the relevant configuration exists.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Leakage depends on a specific non-default pipeline configuration (AC:H) and authenticated access to pipeline output (PR:L); it discloses plaintext secrets (C:H) with no integrity or availability impact.
Primary rating from Vendor (hcl).
CVSS VectorVendor: hcl
DescriptionCVE.org
HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB