EUVD-2026-82428
GHSA-qw5g-vf8h-crwx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authenticated user (PR:L) over the network reads leaked secure values (C:H) with no integrity or availability impact; low complexity given the deterministic redaction failure.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside insecure properties.
AnalysisAI
Information disclosure in HCL DevOps Deploy and HCL Launch lets an authenticated user who can view deployment output recover secure property values that the redaction engine failed to mask. The condition triggers only when a deployment is configured with a secure property whose value begins with certain non-ASCII characters; that encoding case causes subsequent ASCII secure values embedded inside insecure properties to be emitted unmasked into job output and logs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated user (PR:L) with network access to the HCL DevOps Deploy / HCL Launch server and visibility into deployment output/logs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, config-conditional information-disclosure flaw, not a top-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed build published for your branch in HCL knowledge article KB0133573 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133573); the available data does not enumerate an exact patched version number, so the vendor article is the authoritative source for the upgrade target covering 7.3-7.3.2.20, 8.0-8.0.1.15, 8.1-8.1.2.8 and 8.2-8.2.2.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hcl Devops Deploy Hcl Launch
View allSensitive configuration data and credentials are exposed in API responses within HCL DevOps Deploy / HCL Launch, affecti
Sensitive information disclosure in HCL DevOps Deploy / HCL Launch exposes credentials or operational data stored in app
HCL DevOps Deploy and HCL Launch expose sensitive information in pipeline step output logs, enabling any low-privileged
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today