What’s Vulnerable › Vulnerabilities

CVE-2026-76054

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-12
• Weakness: CWE-214

Description

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.

Affected products

• Black Duck blackduck-c-cpp: from 1.0.17 before 3.0.7 — fixed in 3.0.7

How to fix

Upgrade to a fixed version: Black Duck blackduck-c-cpp 3.0.7. Check the vendor advisory for mitigations.

References

• https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-76054-CVE-2026-76055
• https://pypi.org/project/blackduck-c-cpp/

Get alerted when CVE-2026-76054 or the next vulnerability affects your stack