CVE-2026-21811: Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)
HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The vector indicates network access and high privileges are required. No user interaction is required.
Which pipeline artifacts may contain exposed secrets?
Depending on pipeline configuration, secrets may be accessible in task outputs, debug logs, environment-variable dumps, or build-agent scripts. UI masking does not prevent plaintext exposure in these locations.
Are all plugin deployments necessarily affected?
No. The available information states that exposure depends on the pipeline configuration; it does not identify a universally affected default configuration.