CVE-2026-76054CWE-214

CVE-2026-76054

published August 24, 2026

CVSS
7.1
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable.

Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
7.1 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L
EPSS
0.00184 · 7.6th percentile
Weakness
CWE-214 · Invocation of Process Using Visible Sensitive Information
Published
2026-08-24T19:16Z
References (2)
https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-76054-CVE-2026-76055 · [email protected]https://pypi.org/project/blackduck-c-cpp/ · [email protected]
EPSS history
Timeline
  • 26 AUG 08:27Z
    EPSS moved — → 0%
    epss
  • 24 AUG 14:16Z
    Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the…
    cvelistv5