CVE-2026-21811 PUBLISHED

Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)

Assigner: HCL
Reserved: 05.01.2026 Published: 22.10.2026 Updated: 22.10.2026

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 3.8

Product Status

Vendor HCL Software
Product AppScan Integration with Azure Boards for ASoC & A360
Versions Default: unaffected
  • Version Version 1.0.0 is affected

References

Problem Types

  • CWE-522 Insufficiently Protected Credentials CWE