Read the docs
TI-2026-53242 Aliases CVE-2026-76054GHSA-95m4-f2x3-273j

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp…

Priority LOW 30CWE-214Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00184 8th percentileScored 2026-11-07
Fix Fixed blackduck-c-cpp (Black Duck): 3.0.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Black Duckblackduck-c-cpp1.0.17 to before 3.0.73.0.7Patch availableCNA
  • blackduck-c-cpp VendorBlack Duck Affected 1.0.17 to before 3.0.7 Fixed in 3.0.7 Patch available CNA

Remediation

  • Fix · CNA blackduck-c-cpp (Black Duck) Fixed in 3.0.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Black Duck blackduck-c-cpp — Black Duck Product Security Advisory

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-53243 OS command injection in blackduck-c-cppPriority LOW 34
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76054
  2. 2026-10-03 Alias added: GHSA-95m4-f2x3-273j

References

Advisory 1

Other 1

  • TI-2026-01191 Coverity CLI Authentication Bypass CVSS 4.0CRITICAL 9.3
  • TI-2026-07338 Authentication and Authorization Bypass in Coverity Connect CVSS 4.0CRITICAL 9.2
  • TI-2026-07339 SQL Injection in Coverity Connect SOAP API CVSS 4.0HIGH 8.7
  • TI-2024-11153 Stored cross-site scripting in Black Duck Coverity CVSS 4.0HIGH 8.5
  • TI-2026-53243 OS command injection in blackduck-c-cpp CVSS 4.0HIGH 7.5
  • TI-2025-00418 Black Duck SCA Project Privilege Escalation CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences