This vulnerability, tracked as CVE-2025-59874 and categorized under CWE-1027 (Missing Required Cryptographic Step), affects HCL Hive Telco Observability version 1.0. It arises from missing essential directives in the Content Security Policy of the Keycloak component, which is part of the web application. The absence of these directives can compromise the security posture by allowing potentially malicious content or actions that should have been restricted by the CSP. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. There is no vendor-provided patch or official remediation level at this time, and no known exploits have been reported in the wild.

The vulnerability allows attackers to potentially bypass security controls intended by the Content Security Policy, leading to high impact on confidentiality and integrity of the affected system. This could result in unauthorized disclosure or modification of sensitive data within the HCL Hive Telco Observability application. Availability is not impacted. Since no known exploits are reported, active exploitation is not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor vendor communications for updates. Given the vulnerability involves missing CSP directives, reviewing and strengthening the Content Security Policy configuration in the Keycloak component may reduce risk. No official remediation or temporary fix is currently provided by the vendor.