HCL DevOps Deploy Permissive CORS Vulnerability

Who is affected

How to fix it

HCL DevOps Deploy is affected by CVE-2026-56458. The CORS policy can trust untrusted origins, allowing privileged cross-origin actions or data retrieval when an authorized user visits an attacker-controlled page. Patch and enforce a strict origin allowlist.

1. Inventory HCL DevOps Deploy servers and identify which REST APIs are reachable by browsers.
2. Apply the HCL Software fix or mitigation for CVE-2026-56458.
3. Replace wildcard or reflected CORS origins with an explicit allowlist of trusted domains.
4. Disable credentialed cross-origin requests unless they are required and tied to trusted origins.
5. Restrict administrative APIs to VPN, private networks, or trusted reverse proxies.
6. Review access logs for suspicious Origin headers and unusual preflight requests.
7. Invalidate sessions for privileged users if cross-origin exploitation is suspected.

Verify the fix

• Confirm affected APIs no longer return wildcard or reflected Access-Control-Allow-Origin with credentials.
• Run a browser-based cross-origin test from an untrusted origin and confirm the response is blocked.
• Verify trusted automation and UI domains still work after the CORS allowlist change.
• Check logs after deployment for denied untrusted origins.
• Run a Fixnx scan and confirm administrative endpoints are not publicly exposed.

Related categories

Trusted references

FAQ