Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-21811— Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)

Quick assessment

Affected
HCL Software AppScan Integration with Azure Boards for ASoC & A360
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

HCL AppScan Azure Boards 插件可能受到信息泄露漏洞的影响，该漏洞涉及在流水线执行期间以明文形式可访问的密钥。根据流水线配置的不同，这些密钥可能通过任务输出、调试日志、环境变量转储或构建代理脚本被暴露，尽管它们在用户界面中已进行了掩码处理。

CVSS 3.8 · Low EPSS 0.18% · P7

Affected Version Matrix 1

VendorProduct Version RangeStatus
HCL Software AppScan Integration with Azure Boards for ASoC & A360 Version 1.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-21811

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)
Source: CVE Program / CVE List V5
Vulnerability Description
HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
HCL Software AppScan Integration with Azure Boards for ASoC & A360 Version 1.0.0 -

II. Public POCs for CVE-2026-21811

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-21811

请登录查看更多情报信息。

Vendor Pages for CVE-2026-21811 (1)

IV. Related Vulnerabilities

Same product: AppScan Integration with Azure Boards for ASoC & A360
Same vendor: HCL Software
Same weakness: CWE-522

V. Comments for CVE-2026-21811

No comments yet

Leave a comment