CVE-2026-76054

Katalog CVE

CVSS 7.1 · High EPSS 0,18%

Kerentanan Invocation of Process Using Visible Sensitive Information. Skor CVSS 4.0 7.1 (High) menurut synopsys.com.

Deskripsi (NVD)

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.

Rincian

Terbit di NVD

24 Agustus 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 4.0

7.1 (High), sumber synopsys.com
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-214: Invocation of Process Using Visible Sensitive Information

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-76054-CVE-2026-76055
• https://pypi.org/project/blackduck-c-cpp/