EUVD-2026-42555
GHSA-cx4j-m7pg-57q2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible API requires only low-privilege authentication; disclosure is read-only with no integrity or availability impact, and scope does not extend beyond the vulnerable system.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.
AnalysisAI
Sensitive configuration data and credentials are exposed in API responses within HCL DevOps Deploy / HCL Launch, affecting all maintained version branches from 7.3 through 8.2.1.0. Any authenticated user with low-privilege access can retrieve secrets through standard API interactions, creating a stepping-stone for lateral movement or privilege escalation across connected deployment targets. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but real-world risk is elevated because CI/CD platforms routinely store high-value credentials for downstream infrastructure.
Technical ContextAI
HCL DevOps Deploy (formerly IBM UrbanCode Deploy) and HCL Launch are enterprise CI/CD deployment automation platforms that orchestrate application releases across complex hybrid environments, typically storing privileged credentials for cloud services, databases, and infrastructure targets. The root cause is CWE-201 (Insertion of Sensitive Information into Sent Data), meaning the server actively includes confidential values - such as API keys, stored secrets, or deployment credentials - in API response payloads accessible to any authenticated session. The CPE string cpe:2.3:a:hclsoftware:hcl_devops_deploy_/_hcl_launch:*:*:*:*:*:*:*:* confirms a broad affected footprint spanning major version lines 7.3, 8.0, 8.1, and 8.2. Unlike injection or memory-corruption classes, CWE-201 does not require crafted payloads - the server voluntarily discloses sensitive data in otherwise legitimate responses.
RemediationAI
Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131697 for patched versions and apply the vendor-released fix immediately; exact fix version numbers are not independently confirmed from public data and must be obtained from the advisory directly. As an interim compensating control, restrict access to the HCL DevOps Deploy API to only the minimum set of users and service accounts that require it, enforcing role-based access to limit which authenticated identities can reach sensitive configuration endpoints. Immediately audit and rotate any credentials, API keys, or secrets stored within the platform, as exposed values must be treated as compromised. Placing the HCL DevOps Deploy interface behind a VPN or restricting it to internal network segments reduces external attack surface without impacting deployment workflows, though this does not eliminate insider-threat or compromised-credential scenarios.
More in Hcl Devops Deploy Hcl Launch
View allSensitive information disclosure in HCL DevOps Deploy / HCL Launch exposes credentials or operational data stored in app
HCL DevOps Deploy and HCL Launch expose sensitive information in pipeline step output logs, enabling any low-privileged
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today