{"id":"CVE-2026-21811","kind":"vulnerability","aliases":["CVE-2026-21811"],"related":[],"title":"HCL AppScan Azure Boards Plugin: secrets readable in plaintext during pipeline runs","description":"HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.","summary":"The HCL AppScan Azure Boards plugin can expose secrets in plaintext while a pipeline runs, even though the Azure DevOps interface masks them. Depending on pipeline configuration, the values can leak through task outputs, debug logs, environment variable dumps or build agent scripts.","severity":"low","cvss":3.8,"epss":0.00183,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azure-devops","ci-cd","hcl-appscan","other"],"not_affected_if":["no-secrets-in-pipeline","plugin-not-installed"],"how_to_check":"- Check whether the HCL AppScan Azure Boards plugin is installed in your Azure DevOps organization (Organization settings, Extensions).\n- Review pipelines that use the plugin for secret variables passed to it and for debug logging enabled in those runs.\n- Version: unknown","fix":"- Update the HCL AppScan Azure Boards plugin to a fixed version: unknown\n- Rotate any secrets that were passed to pipelines using the plugin, if build logs or agent output may have been seen by others.","status":"open","published_at":"2026-10-22T09:17:16+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:43:11+00:00","updated_at":"2026-10-25T04:43:11+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:43:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update the HCL AppScan Azure Boards plugin to a fixed version: unknown\n- Rotate any secrets that were passed to pipelines using the plugin, if build logs or agent output may have been seen by others.","reach":"unknown","title":"HCL AppScan Azure Boards Plugin: secrets readable in plaintext during pipeline runs","impact":"medium","summary":"The HCL AppScan Azure Boards plugin can expose secrets in plaintext while a pipeline runs, even though the Azure DevOps interface masks them. Depending on pipeline configuration, the values can leak through task outputs, debug logs, environment variable dumps or build agent scripts.","category":"other","nicknames":[],"who_cares":["azure-devops","ci-cd","hcl-appscan"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Pipeline secrets readable in logs or agent output by people with pipeline access","analyst_note":"Find the affected version range and fixed release in the NVD entry or HCL advisory; sources give no version.","how_to_check":"- Check whether the HCL AppScan Azure Boards plugin is installed in your Azure DevOps organization (Organization settings, Extensions).\n- Review pipelines that use the plugin for secret variables passed to it and for debug logging enabled in those runs.\n- Version: unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-secrets-in-pipeline"],"who_is_affected":"Teams that run the HCL AppScan Azure Boards plugin in Azure DevOps pipelines and pass secrets through them are potentially affected. Teams without this plugin installed, or without secrets flowing through pipelines that use it, can skip it. Fixed version and exact affected range: unknown.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000666,"input_tokens":3380,"output_tokens":655,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-21811':15A,18A 'access':86C 'affect':78C 'agent':69B,112C 'appscan':2A,27B,30B,72C 'azur':3A,20B,31B,46B,73C 'azure-devop':19B 'board':4A,32B,74C 'build':68B,111C 'cd':24B 'ci':23B 'ci-cd':22B 'configur':54B,96C 'could':99C 'cve':13A,16A 'debug':62B,105C 'depend':51B,92C 'despit':114C 'devop':21B,47B 'disclosur':82C 'dump':66B,109C 'environ':64B,107C 'even':43B 'execut':91C 'expos':35B,101C 'hcl':1A,26B,29B,71C 'hcl-appscan':25B 'inform':81C 'interfac':48B,120C 'involv':84C 'leak':58B 'log':63B,106C 'mask':49B,116C 'output':61B,104C 'pipelin':11A,41B,53B,90C,95C 'plaintext':9A,38B,88C 'plugin':5A,33B,75C 'potenti':77C 'readabl':7A 'run':12A,42B 'script':70B,113C 'secret':6A,36B,85C,98C 'task':60B,103C 'though':44B 'user':119C 'valu':56B 'variabl':65B,108C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the HCL AppScan Azure Boards plugin in Azure DevOps pipelines and pass secrets through them are potentially affected. Teams without this plugin installed, or without secrets flowing through pipelines that use it, can skip it. Fixed version and exact affected range: unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-21811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21811","severity":null,"published_at":"2026-10-22T09:17:16+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-21811","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21811","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}