# CVE-2025-59874: HCL Hive Telco Observability Missing CSP Directives in Keycloak

Source: https://junglewise.ai/threats/cve-2025-59874-hcl-hive-telco-observability-missing-csp-directives-in-keycloak  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2025-59874 · Severity: high · CVSS 8.1 · Published 2026-06-04

HCL Hive Telco Observability, a platform used by telecommunications providers to monitor network performance, contains a security weakness in its login and identity management component. The web application fails to implement proper Content Security Policy (CSP) directives, which are digital guardrails that prevent unauthorized scripts from running. If exploited, this could allow attackers to perform malicious actions in a user's browser, potentially leading to data theft or unauthorized account access.

Vendors: [HCL](https://junglewise.ai/threats/vendors/hcl).

## Quick answers

**Is CVE-2025-59874 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59874 being exploited in the wild.

**How severe is CVE-2025-59874?** High severity, with a CVSS score of 8.1, published 4 June 2026.

**Which products and versions are affected?** HCL Hive Telco Observability.

**Is there a fix for CVE-2025-59874?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-59874 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-59874?** Check whether you run HCL Hive Telco Observability. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Keycloak component of HCL Hive Telco Observability due to missing essential Content Security Policy (CSP) directives. This misconfiguration allows for the bypass of browser-side security controls intended to prevent unauthorized resource loading and script execution. An unauthenticated remote attacker can exploit this by inducing a user to interact with a malicious link or site (UI:R), potentially leading to Cross-Site Scripting (XSS) or clickjacking attacks. Successful exploitation can result in high impacts to confidentiality and integrity as the attacker may execute arbitrary scripts in the context of the victim's session. The issue is tracked as CVE-2025-59874 with a CVSS base score of 8.1.

## Affected products

- HCL Hive Telco Observability

## Timeline

- 2026-06-04: disclosed: Initial NVD publication date
- 2026-06-04: advisory: HCL Software security bulletin published

## References

- [https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128725](https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128725)