CVE-2026-56458: HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains
Published Jul 9, 2026
·Updated
HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
Affected Software
3 affected components
HCL HCL DevOps Deploy
Hcltechsw Hcl Devops Deploy>=8.1.0.0<8.1.2.7
Hcltechsw Hcl Devops Deploy>=8.2.0.0<8.2.2.0
Event History
Jul 9, 2026
CVE Published
via MITRE·08:51 AM
Data Sourced
via MITRE·08:51 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-56458?
The severity of CVE-2026-56458 is medium with a score of 5.4.
2
What vulnerabilities are associated with CVE-2026-56458?
CVE-2026-56458 is associated with permissive cross-domain security policies that could expose sensitive information to untrusted domains.
3
How do I fix CVE-2026-56458?
To fix CVE-2026-56458, configure your Cross-Origin Resource Sharing (CORS) policy to restrict requests to trusted domains only.
4
What software is affected by CVE-2026-56458?
CVE-2026-56458 affects HCL DevOps Deploy software.
5
What type of attack can CVE-2026-56458 enable?
CVE-2026-56458 can enable attackers to carry out privileged actions and retrieve sensitive information by exploiting CORS.