CVE-2026-21790— HCL Traveler is susceptible to a weak default HTTP header validation vulnerability
Quick assessment
Affected
HCLSoftware Traveler
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HCL Traveler是印度HCL公司的一款软件。用于在 HCL Domino 服务器和无线手持设备之间提供自动、双向、无线同步。 HCL Traveler存在安全漏洞，该漏洞源于HTTP标头验证较弱，可能导致攻击者绕过额外身份验证检查。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-21790
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL Traveler is susceptible to a weak default HTTP header validation vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional authentication checks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5
Vulnerability Title
HCL Traveler 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Traveler是印度HCL公司的一款软件。用于在 HCL Domino 服务器和无线手持设备之间提供自动、双向、无线同步。 HCL Traveler存在安全漏洞，该漏洞源于HTTP标头验证较弱，可能导致攻击者绕过额外身份验证检查。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCLSoftware | Traveler | < 14.5.1.0 | - |
|
II. Public POCs for CVE-2026-21790
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-21790
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-21790 (1)
IV. Related Vulnerabilities
Same product: Traveler
-
CVE-2026-93947
WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerabil -
CVE-2026-56547
An input reflection vulnerability affects HCL Traveler -
CVE-2026-21783
HCL Traveler is affected by sensitive information disclosure -
CVE-2026-25449
WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vu -
CVE-2026-24367
WordPress Traveler theme < 3.2.8 - SQL Injection vulnerabili
Same vendor: HCLSoftware
-
CVE-2026-67075
HCL Digital Experience is affected by improper input sanitat -
CVE-2026-67071
HCL DevOps Deploy / HCL Launch is susceptible to an Improper -
CVE-2026-21827
HCL Connections is vulnerable to an information disclosure v -
CVE-2025-62341
HCL Connections is vulnerable to server-side request forgery -
CVE-2026-21808
HCL BigFix Quantum Risk Analyzer is affected by logging sens
Same weakness: CWE-346
-
CVE-2026-108265
enclave-os-mini: RA-TLS challenge certificates were not boun -
CVE-2026-108261
TinaCMS admin preview iframe loads an attacker-controlled or -
CVE-2026-107804
Nginx UI: Bundled reverse proxy can bypass IP allowlists and -
CVE-2026-107292
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the -
CVE-2026-104659
Origin Validation Error in hMailServer
V. Comments for CVE-2026-21790
No comments yet