CVE-2026-76054
- State
- Published
- Severity
- 7.1 High
- Published
- Aug 24, 2026
- Updated
- Aug 24, 2026
- Reserved
- Aug 18, 2026
Description
Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable.
Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L | BlackDuck |
Weaknesses
- CWE-214 Invocation of Process Using Visible Sensitive Information
Affected Products
| Product | Versions |
|---|---|
blackduck-c-cppBlack Duck |
|
References
- Black Duck Product Security Advisoryvendor-advisory
- blackduck-c-cpp on PyPIproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.