CVE-2026-21761 identifies a CORS misconfiguration in HCL DevOps Loop 2.0.0, where the cross-domain policy is overly permissive and includes untrusted domains. This improper configuration may enable unauthorized cross-origin requests, potentially allowing untrusted external domains to access application resources that should be restricted. The vulnerability is categorized as CWE-942 (Permissive Cross-Domain Policy with Untrusted Domains). The CVSS v3.1 base score is 4.2, reflecting low confidentiality and integrity impacts with no availability impact, requiring low privileges and high attack complexity.

The vulnerability could allow unauthorized cross-origin requests from untrusted domains, potentially exposing sensitive application resources or data to attackers. The impact is limited to confidentiality and integrity with no direct availability impact. Exploitation requires low privileges but has high attack complexity, reducing the likelihood of widespread exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor HCLSoftware advisories for updates. Until a fix is available, review and restrict CORS policies to only trusted domains to mitigate exposure.