{"id":"CVE-2026-21812","kind":"vulnerability","aliases":["CVE-2026-21812"],"related":[],"title":"HCL AppScan Azure Boards Plugin: credentials sent in cleartext over HTTP","description":"HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.","summary":"The HCL AppScan Azure Boards plugin sends data to the AppScan server over plain HTTP when configured that way. An attacker on the network path could intercept credentials or authentication tokens.","severity":"low","cvss":2.2,"epss":0.00119,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appscan","azure-boards","hcl","other"],"not_affected_if":["https-only"],"how_to_check":"- Open the plugin's AppScan server URL setting and check whether it starts with `http://` rather than `https://`\n- unknown for other checks","fix":"- Change the AppScan server URL to `https://` and update the plugin to the version that displays the HTTP warning (version unknown)","status":"open","published_at":"2026-10-22T09:17:16+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:49:57+00:00","updated_at":"2026-10-25T04:49:57+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:49:57Z","model":"claude-haiku-5-5","output":{"fix":"- Change the AppScan server URL to `https://` and update the plugin to the version that displays the HTTP warning (version unknown)","reach":"network","title":"HCL AppScan Azure Boards Plugin: credentials sent in cleartext over HTTP","impact":"medium","summary":"The HCL AppScan Azure Boards plugin sends data to the AppScan server over plain HTTP when configured that way. An attacker on the network path could intercept credentials or authentication tokens.","category":"other","nicknames":[],"who_cares":["appscan","azure-boards","hcl"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Credentials and tokens readable by anyone on the network path","analyst_note":"Check the HCL advisory for affected plugin versions and the exact fixed version; the NVD entry gives no version range.","how_to_check":"- Open the plugin's AppScan server URL setting and check whether it starts with `http://` rather than `https://`\n- unknown for other checks","needs_analyst":true,"not_affected_if":["https-only"],"who_is_affected":"Teams that run the HCL AppScan Azure Boards plugin and point it at an AppScan server reached over plain HTTP. Installations already using HTTPS to the AppScan server are not exposed by this flaw; the sources do not name the affected plugin versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000589,"input_tokens":3391,"output_tokens":499,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-21812':14A,17A 'affect':60C 'allow':81C 'appscan':2A,18B,25B,33B,55C,75C 'attack':43B,83C 'authent':52B,88C 'azur':3A,20B,26B,56C 'azure-board':19B 'board':4A,21B,27B,57C 'cleartext':9A,63C 'communic':72C,110C 'configur':39B,70C 'could':48B,80C 'credenti':6A,50B,86C 'cve':12A,15A 'data':30B 'display':98C 'hcl':1A,22B,24B,54C 'http':11A,37B,78C,102C 'https':107C 'inform':67C 'intercept':49B,85C 'network':46B 'path':47B 'plain':36B 'plugin':5A,28B,58C,93C 'recommend':106C 'secur':109C 'send':29B 'sensit':66C 'sent':7A 'server':34B,76C 'token':53B,89C 'transmiss':64C,91C 'updat':96C 'use':104C 'vulner':68C 'warn':100C 'way':41B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the HCL AppScan Azure Boards plugin and point it at an AppScan server reached over plain HTTP. Installations already using HTTPS to the AppScan server are not exposed by this flaw; the sources do not name the affected plugin versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-21812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21812","severity":null,"published_at":"2026-10-22T09:17:16+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-21812","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21812","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}