PT-2026-80889
CVE-2026-76054
·
Published
2026-08-24
·
Updated
2026-08-24
Description by
CVSS 4.0
7.1
HighMetricsAV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
blackduck-c-cpp versions 1.0.17 through 3.0.6
Description
An issue exists where an actor capable of executing code within the build of a scanned project can obtain the Black Duck API token. This occurs because the token is passed through the ambient process environment and inherited by subprocesses launched during build capture and signature scanning. This issue specifically affects configurations where the token is provided via the
BLACKDUCK API TOKEN or BD HUB TOKEN environment variables.Recommendations
Update blackduck-c-cpp to a version later than 3.0.6.
Rotate any API tokens that were supplied to affected versions through environment variables.
Found an issue in the description? Have something to add? Feel free to write us 👾