---
id: "CVE-2026-21812"
kind: "vulnerability"
aliases: ["CVE-2026-21812"]
title: "HCL AppScan Azure Boards Plugin: credentials sent in cleartext over HTTP"
severity: "low"
cvss: 2.2
epss: 0.00119
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["appscan", "azure-boards", "hcl", "other"]
not_affected_if: ["https-only"]
published_at: "2026-10-22T09:17:16+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:49:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21812", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-21812", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HCL AppScan Azure Boards Plugin: credentials sent in cleartext over HTTP

The HCL AppScan Azure Boards plugin sends data to the AppScan server over plain HTTP when configured that way. An attacker on the network path could intercept credentials or authentication tokens.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Open the plugin's AppScan server URL setting and check whether it starts with `http://` rather than `https://`
- unknown for other checks

## Fix

- Change the AppScan server URL to `https://` and update the plugin to the version that displays the HTTP warning (version unknown)

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-21812
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-21812

## From the sources

HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_