---
id: "CVE-2026-21811"
kind: "vulnerability"
aliases: ["CVE-2026-21811"]
title: "HCL AppScan Azure Boards Plugin: secrets readable in plaintext during pipeline runs"
severity: "low"
cvss: 3.8
epss: 0.00183
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["azure-devops", "ci-cd", "hcl-appscan", "other"]
not_affected_if: ["no-secrets-in-pipeline", "plugin-not-installed"]
published_at: "2026-10-22T09:17:16+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:43:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21811", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-21811", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HCL AppScan Azure Boards Plugin: secrets readable in plaintext during pipeline runs

The HCL AppScan Azure Boards plugin can expose secrets in plaintext while a pipeline runs, even though the Azure DevOps interface masks them. Depending on pipeline configuration, the values can leak through task outputs, debug logs, environment variable dumps or build agent scripts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the HCL AppScan Azure Boards plugin is installed in your Azure DevOps organization (Organization settings, Extensions).
- Review pipelines that use the plugin for secret variables passed to it and for debug logging enabled in those runs.
- Version: unknown

## Fix

- Update the HCL AppScan Azure Boards plugin to a fixed version: unknown
- Rotate any secrets that were passed to pipelines using the plugin, if build logs or agent output may have been seen by others.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-21811
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-21811

## From the sources

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_