CVE-2026-76054

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76054", "assignerOrgId": "8cad7728-009c-4a3d-a95e-ca62e6ff8a0b", "state": "PUBLISHED", "assignerShortName": "BlackDuck", "dateReserved": "2026-08-18T20:17:15.954Z", "datePublished": "2026-08-24T14:16:36.118Z", "dateUpdated": "2026-08-24T15:00:34.809Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8cad7728-009c-4a3d-a95e-ca62e6ff8a0b", "shortName": "BlackDuck", "dateUpdated": "2026-08-24T14:16:36.118Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-214", "description": "CWE-214 Invocation of Process Using Visible Sensitive Information", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Disclosure of the Black Duck API token to processes running on the host performing the scan. The token authenticates to the Black Duck instance and, in the configuration documented as the minimum for scanning to a new project, permits reading all projects, Bills of Materials, and code locations on that instance and creating, modifying, or deleting projects, versions, and code locations."}]}], "affected": [{"vendor": "Black Duck", "product": "blackduck-c-cpp", "collectionURL": "https://pypi.org", "packageName": "blackduck-c-cpp", "versions": [{"status": "affected", "version": "1.0.17", "lessThan": "3.0.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable.\n\n\n\nUpgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the <code>BLACKDUCK_API_TOKEN</code> or <code>BD_HUB_TOKEN</code> environment variable.</p><p>Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.</p>"}]}], "references": [{"url": "https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-76054-CVE-2026-76055", "name": "Black Duck Product Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://pypi.org/project/blackduck-c-cpp/", "name": "blackduck-c-cpp on PyPI", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}, "credits": [{"lang": "en", "value": "NVIDIA", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-24T15:00:18.957895Z", "id": "CVE-2026-76054", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T15:00:34.809Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76054", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T15:00:18.957895Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T15:00:28.065Z"}}], "cna": {"source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "NVIDIA"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Disclosure of the Black Duck API token to processes running on the host performing the scan. The token authenticates to the Black Duck instance and, in the configuration documented as the minimum for scanning to a new project, permits reading all projects, Bills of Materials, and code locations on that instance and creating, modifying, or deleting projects, versions, and code locations."}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Black Duck", "product": "blackduck-c-cpp", "versions": [{"status": "affected", "version": "1.0.17", "lessThan": "3.0.7", "versionType": "semver"}], "packageName": "blackduck-c-cpp", "collectionURL": "https://pypi.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-76054-CVE-2026-76055", "name": "Black Duck Product Security Advisory", "tags": ["vendor-advisory"]}, {"url": "https://pypi.org/project/blackduck-c-cpp/", "name": "blackduck-c-cpp on PyPI", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable.\n\n\n\nUpgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.", "supportingMedia": [{"type": "text/html", "value": "<p>Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the <code>BLACKDUCK_API_TOKEN</code> or <code>BD_HUB_TOKEN</code> environment variable.</p><p>Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-214", "description": "CWE-214 Invocation of Process Using Visible Sensitive Information"}]}], "providerMetadata": {"orgId": "8cad7728-009c-4a3d-a95e-ca62e6ff8a0b", "shortName": "BlackDuck", "dateUpdated": "2026-08-24T14:16:36.118Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76054", "state": "PUBLISHED", "dateUpdated": "2026-08-24T15:00:34.809Z", "dateReserved": "2026-08-18T20:17:15.954Z", "assignerOrgId": "8cad7728-009c-4a3d-a95e-ca62e6ff8a0b", "datePublished": "2026-08-24T14:16:36.118Z", "assignerShortName": "BlackDuck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.org", "defaultStatus": "unaffected", "packageName": "blackduck-c-cpp", "product": "blackduck-c-cpp", "vendor": "Black Duck", "versions": [{"lessThan": "3.0.7", "status": "affected", "version": "1.0.17", "versionType": "semver"}]}], "source": "disclosure@synopsys.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable.\n\n\n\nUpgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated."}, {"lang": "es", "value": "Invocaci\u00f3n de proceso utilizando informaci\u00f3n sensible visible en Black Duck blackduck-c-cpp 1.0.17 hasta 3.0.6 permite a un actor capaz de ejecutar c\u00f3digo dentro de la compilaci\u00f3n del proyecto escaneado obtener el token de la API de Black Duck a trav\u00e9s del entorno de proceso ambiente, el cual es heredado por los subprocesos lanzados durante la captura de compilaci\u00f3n y el escaneo de firmas. Esto aplica solo cuyo el token se suministra a trav\u00e9s de la variable de entorno BLACKDUCK_API_TOKEN o BD_HUB_TOKEN.\n\nLa actualizaci\u00f3n no remedia la divulgaci\u00f3n previa; cualquier token suministrado a una versi\u00f3n afectada a trav\u00e9s de una variable de entorno debe ser rotado."}], "id": "CVE-2026-76054", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@synopsys.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76054", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-24T15:00:18.957895Z", "version": "2.0.3"}}]}, "published": "2026-08-24T15:16:46.650", "references": [{"source": "disclosure@synopsys.com", "url": "https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-76054-CVE-2026-76055"}, {"source": "disclosure@synopsys.com", "url": "https://pypi.org/project/blackduck-c-cpp/"}], "sourceIdentifier": "disclosure@synopsys.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-214"}], "source": "disclosure@synopsys.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.17,3.0.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "blackduck-c-cpp", "vendor": "black_duck"}], "created": "2026-08-24T21:10:43.811783+00:00", "title": "API Token Exposure via Build Process in Black Duck blackduck-c-cpp", "updated": "2026-08-24T21:15:07.252939+00:00", "vendors": ["black_duck", "black_duck$PRODUCT$blackduck-c-cpp"]}