What is the CVSS score of EUVD-2026-45231?

EUVD-2026-45231 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

HCL DevOps Loop EUVD-2026-45231

| CVE-2026-21761 MEDIUM

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-07-17 psirt@hcl.com

GHSA-mvhg-pqfh-v42v

Authentication Bypass Cors Misconfiguration Devops Loop Hcltech

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.2 MEDIUM

Aligns with vendor vector: network access, authenticated (PR:L), high complexity for cross-origin setup; limited C/I impact, no availability loss.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Aug 13, 2026 - 13:07 NVD

4.2 (MEDIUM) 5.4 (MEDIUM)

Analysis Generated

Jul 17, 2026 - 17:32 vuln.today

DescriptionNVD

HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.

AnalysisAI

CORS misconfiguration in HCL DevOps Loop enables authenticated network-adjacent attackers to perform unauthorized cross-origin requests against the application. The improper CORS policy potentially allows untrusted domains to read application responses, exposing session-bound resources to attacker-controlled origins. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the tag 'Authentication Bypass' suggests resource exposure can undermine access control assumptions.

Technical ContextAI

CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) describes a server-side misconfiguration where the HTTP CORS headers - specifically Access-Control-Allow-Origin and related preflight response headers - are insufficiently restricted. When a browser-based application reflects arbitrary Origin values or allows overly broad wildcard policies, scripts from untrusted domains can make credentialed cross-origin XMLHttpRequest or Fetch API calls and read responses that should be confined to the legitimate origin. HCL DevOps Loop is an HCL Software CI/CD and DevOps orchestration platform; the affected component is its web-accessible API or UI surface, inferred from the network attack vector and the browser-enforced nature of CORS policy enforcement. No CPE strings were provided in the input data, so exact version-level product scoping is not available from NVD.

RemediationAI

Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132296 for patch availability and exact fixed version numbers, as no specific patched release was provided in the input data. The primary remediation for CWE-942 is to restrict the Access-Control-Allow-Origin header to an explicit allowlist of trusted origins rather than reflecting arbitrary Origin values or using wildcards with credentialed requests. As a compensating control, network-layer restrictions can limit which origins can reach the DevOps Loop application interface, reducing exposure while a patch is applied. Disabling CORS entirely on sensitive API endpoints where cross-origin access is not functionally required is another option, though this may break legitimate integrations and should be tested in staging first. Do not combine Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true, as browsers block this combination for credentialed requests.