CVE-2026-67071: HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer
HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulnerability when processing redacted property values. If a deployment is configured with a secure property that starts with certain non-ASCII characters, the redaction engine may fail to mask subsequent ASCII secure values embedded inside insecure properties.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires a deployment configuration that uses a secure property beginning with certain non-ASCII characters and includes subsequent ASCII secure values embedded in insecure properties. Configurations that do not use this property pattern are not described as affected.
What access does an attacker need to exploit the issue?
The vector indicates network access, low attack complexity, no user interaction, and low privileges required. The disclosed information is limited by the vulnerable redaction behavior during processing of property values.
What should be reviewed to identify possible exposure?
Review deployment configurations and related output where secure properties begin with non-ASCII characters. Check whether ASCII secure values may have been embedded in insecure properties and therefore appeared without masking.