CVE-2026-21754: CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag in HCL Software Hive

CVE-2026-21754 identifies a vulnerability in HCL Software Hive version 1.0 where sensitive cookies lack the 'HttpOnly' flag (CWE-1004). This omission can allow client-side scripts to access these cookies, potentially leading to unauthorized lateral movement, container breakout, and sensitive data exposure within the internal network. The CVSS 3.1 base score is 5.4 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

The vulnerability could allow attackers to access sensitive cookies via client-side scripts, which may facilitate unauthorized lateral movement within the internal network, container breakout, and exposure of sensitive data in internal communications. However, exploitation requires user interaction and does not affect system availability.

No official patch or remediation guidance is currently provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider minimizing exposure of sensitive cookies and applying defensive measures such as restricting client-side script access where possible.