HCL Hive Telco Observability version 1.0 contains a vulnerability identified as CVE-2025-59874, classified under CWE-1027 (Missing Required Cryptographic Step). The issue arises from missing essential Content Security Policy directives in the keycloak component of the web application, which can weaken the security posture by allowing potential exploitation of the web application's cryptographic protections. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity. No known exploits are reported in the wild, and no vendor-provided patch or remediation is currently documented.

The vulnerability can lead to significant confidentiality and integrity breaches due to missing CSP directives in the keycloak component, potentially allowing attackers to bypass security controls that rely on cryptographic protections. Availability impact is not affected. The high CVSS score reflects the potential severity of exploitation if an attacker can induce a user to interact with the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor vendor communications for updates. No specific mitigations or workarounds are documented at this time.