CVE-2026-21762
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
HCL DevOps Loop is missing HTTP security headers, which reduces browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.
Risk Assessment
Missing security headers increase the risk of successful attacks against application users, potentially leading to data theft, session hijacking, or malicious content injection.
Recommendation
Configure the HCL DevOps Loop application server to include appropriate HTTP security headers (e.g., X-Frame-Options, X-Content-Type-Options, Content-Security-Policy).
Original NVD description (English source)
HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.