CVE-2026-76054
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.
| CWE | CWE-214 |
| Vendor | black duck |
| Product | blackduck-c-cpp |
| Published | Aug 24, 2026 |
| Last Updated | Aug 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for black duck blackduck-c-cpp
Be the first to know when new unknown vulnerabilities affecting black duck blackduck-c-cpp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Black Duck / blackduck-c-cpp
1.0.17 < 3.0.7
References
Credits
NVIDIA