CVE-2026-67071 describes an information disclosure vulnerability in HCL DevOps Deploy / HCL Launch. The issue arises from improper removal of sensitive information before storage or transfer (CWE-212). Specifically, if a secure property used in deployment starts with certain non-ASCII characters, the redaction engine may not properly mask subsequent ASCII secure values embedded inside insecure properties, leading to potential exposure of sensitive data. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, low attack complexity, requiring low privileges and no user interaction, and impacting confidentiality only.

The vulnerability can lead to unauthorized disclosure of sensitive information due to failure of the redaction engine to mask secure property values under specific conditions. This could expose confidential data embedded in insecure properties during deployment processes. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or workaround information is provided, users should monitor HCLSoftware advisories for updates. Until a fix is available, carefully review deployment configurations involving secure properties with non-ASCII characters and limit exposure of sensitive data in insecure properties where possible.