HCL DevOps Deploy EUVD-2026-40091

Exploitation requires an active authenticated session with at minimum low-privilege access to HCL DevOps Deploy or HCL Launch (PR:L per CVSS), and permission to view step output logs for at least one pipeline execution that processed sensitive values. The sensitive values must actually be present in a pipeline step's log output - meaning the step must have referenced, echoed, or interpolated a credential, token, or secret in a way captured by the logging subsystem. Exploitation is strictly limited by the authentication requirement: unauthenticated remote attackers cannot access logs. Risk is further bounded by the specific pipelines a given user can access; users restricted to low-sensitivity pipelines would not expose high-value secrets. Non-default log permission grants or overly broad role assignments amplify real-world risk beyond what the base CVSS score implies.

The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is well-calibrated to the actual risk: exploitation requires authenticated access (PR:L), ruling out anonymous exploitation, and impact is bounded to partial confidentiality (C:L) - limited to what sensitive values appear in accessible logs rather than systemic data exfiltration. No EPSS data was supplied in the input, so exploitation likelihood cannot be quantified numerically. This CVE is not in the CISA KEV catalog and no POC has been identified, suggesting no active or widespread exploitation at time of analysis. Despite the moderate CVSS, real-world risk is meaningfully elevated in environments where pipeline logs are broadly accessible across development teams, as exposed secrets can serve as a pivot point into downstream infrastructure. The CPE wildcard version is a data gap - no specific patched release is confirmed, which complicates remediation scoping.

An authenticated developer or operator with low-level access browses step output logs for a recently executed deployment pipeline that processes sensitive infrastructure credentials or API tokens. Because those values are not masked in the log output, the attacker reads them in plaintext directly from the HCL DevOps Deploy web UI, then uses the extracted credentials to authenticate against downstream systems such as cloud APIs, databases, or container registries. No public exploit code has been identified, so exploitation relies on manual log inspection rather than an automated attack tool.