CVE-2026-21761: HCL DevOps Loop CORS Bypass Vulnerability

CVE-2026-21761 Overview

CVE-2026-21761 affects HCL DevOps Loop through a Cross-Origin Resource Sharing (CORS) misconfiguration. The flaw permits unauthorized cross-origin requests, which can expose application resources to untrusted domains. HCL Software assigned this issue a medium severity rating with a CVSS score of 4.2.

The vulnerability is categorized under CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). Exploitation requires network access and authenticated low-privilege access, with high attack complexity. Successful exploitation can result in limited confidentiality and integrity impact against the affected application.

Critical Impact
An improperly configured CORS policy in HCL DevOps Loop allows untrusted origins to issue cross-origin requests, potentially exposing application resources and enabling limited data disclosure or modification through victim browsers.

Affected Products

HCL DevOps Loop

Discovery Timeline

2026-07-17 - CVE-2026-21761 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-21761

Vulnerability Analysis

HCL DevOps Loop implements a CORS policy that trusts origins it should not. CORS is a browser-enforced mechanism that governs how web pages loaded from one origin can request resources from another. When a server returns overly permissive CORS response headers, browsers relax the Same-Origin Policy for the specified origins.

Under this misconfiguration, an attacker-controlled site can trigger cross-origin requests from an authenticated victim's browser to the HCL DevOps Loop application. If the server responds with Access-Control-Allow-Credentials: true alongside a reflected or wildcard Access-Control-Allow-Origin value, the attacker's page can read the response content.

The issue is classified as CWE-942. The EPSS probability score for exploitation is 0.145%.

Root Cause

The root cause is a permissive cross-domain policy in HCL DevOps Loop's HTTP response handling. The server accepts origins that should not be trusted for credentialed cross-origin access. This defect falls into the class of insecure default or overly broad access control configurations.

Attack Vector

An attacker hosts a malicious web page and lures an authenticated HCL DevOps Loop user to visit it. The malicious page issues cross-origin fetch or XMLHttpRequest calls to the DevOps Loop backend. Because the CORS policy permits the attacker's origin, the victim's browser attaches session credentials and returns the response to the attacker's script.

The attack requires user interaction from an authenticated user session, network reachability to the target, and specific conditions that make the attack complexity high. Refer to the HCL Software Knowledge Base Article for vendor technical details.

Detection Methods for CVE-2026-21761

Indicators of Compromise

HTTP requests to HCL DevOps Loop endpoints containing an Origin header referencing untrusted or unexpected external domains.
Server responses that echo attacker-controlled origins in Access-Control-Allow-Origin alongside Access-Control-Allow-Credentials: true.
Anomalous session activity from authenticated users immediately following external web browsing sessions.

Detection Strategies

Inspect web server and reverse proxy access logs for Origin header values that do not match approved application domains.
Deploy web application firewall (WAF) rules that flag CORS preflight (OPTIONS) requests originating from unknown domains.
Correlate authentication events with cross-origin API activity to identify browser-driven data exfiltration patterns.

Monitoring Recommendations

Ingest HCL DevOps Loop access and application logs into a centralized SIEM for continuous review of CORS response headers.
Enable browser security telemetry where available to detect credentialed cross-origin fetches to sensitive endpoints.
Alert on any deviation from an allowlist of expected origins interacting with DevOps Loop APIs.

How to Mitigate CVE-2026-21761

Immediate Actions Required

Review the HCL Software Knowledge Base Article and apply the vendor guidance to affected HCL DevOps Loop deployments.
Restrict the application's CORS allowlist to explicitly trusted, fully qualified origins only.
Disable Access-Control-Allow-Credentials: true on endpoints that do not require credentialed cross-origin access.

Patch Information

HCL Software has published remediation guidance in knowledge base article KB0132296. Administrators should consult the HCL Software Knowledge Base Article for supported versions, configuration steps, and any available patches for HCL DevOps Loop.

Workarounds

Enforce a strict origin allowlist at the reverse proxy or load balancer in front of HCL DevOps Loop until the vendor fix is applied.
Remove wildcard (*) values and reflected Origin echoing from Access-Control-Allow-Origin response headers.
Require additional CSRF protections such as SameSite session cookies and anti-CSRF tokens on state-changing endpoints.
Instruct users to authenticate to HCL DevOps Loop only from managed browsers and to avoid browsing untrusted sites within the same session.

bash

# Example NGINX configuration enforcing a strict CORS allowlist
map $http_origin $cors_allowed_origin {
    default "";
    "https://devops-loop.example.com" $http_origin;
    "https://ci.example.com"          $http_origin;
}

server {
    listen 443 ssl;
    server_name devops-loop.example.com;

    location /api/ {
        if ($cors_allowed_origin = "") {
            return 403;
        }

        add_header Access-Control-Allow-Origin      $cors_allowed_origin always;
        add_header Access-Control-Allow-Credentials "true" always;
        add_header Access-Control-Allow-Methods     "GET, POST, OPTIONS" always;
        add_header Vary                             "Origin" always;

        proxy_pass http://devops_loop_backend;
    }
}