CVE-2026-21811: CWE-522 Insufficiently Protected Credentials in HCL Software AppScan Integration with Azure Boards for ASoC & A360
Description
CVE-2026-21811 is an information disclosure vulnerability in HCL AppScan Azure Boards Plugin that may expose secrets in plaintext during pipeline execution. These secrets can be revealed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface. The vulnerability has a low severity rating and requires privileged access to exploit.
CVSS v3.1
Score 3.8low
Affected software
HCL Software
AppScan Integration with Azure Boards for ASoC & A360
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
HCL AppScan Integration with Azure Boards for ASoC & A360 contains an insufficiently protected credentials vulnerability (CWE-522) where secrets used in pipeline executions may be exposed in plaintext. This exposure can occur depending on pipeline configuration, potentially leaking secrets via task outputs, debug logs, environment variable dumps, or build agent scripts, even though the UI masks these secrets. The CVSS 3.1 score is 3.8 (low severity), with network attack vector, low attack complexity, high privileges required, no user interaction, and limited confidentiality and integrity impact. The product is a cloud service, and a patch is available.
Potential Impact
The vulnerability could lead to partial disclosure of sensitive credentials during pipeline execution, which might be accessed by users with high privileges. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild.
Mitigation Recommendations
A patch is available for this vulnerability. Since this is a cloud-hosted service, the vendor manages remediation. Users should apply the official fix as provided by HCL Software. Review pipeline configurations to minimize exposure of secrets in logs and outputs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- HCL
- Date Reserved
- 2026-01-05T16:08:13.112Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6ad9d4514d27ba8daa426c81
Added to database: 10/22/2026, 09:16:01 UTC
Last enriched: 10/22/2026, 09:30:46 UTC
Last updated: 10/22/2026, 13:31:34 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.