Black Duck blackduck-c-cpp up to 3.0.6 Build Capture/Signature Scanning BLACKDUCK_API_TOKEN/BD_HUB_TOKEN information disclosure

Summaryinfo

A vulnerability was found in Black Duck blackduck-c-cpp up to 3.0.6. It has been classified as problematic. This affects an unknown part of the component Build Capture/Signature Scanning. This manipulation of the argument BLACKDUCK_API_TOKEN/BD_HUB_TOKEN causes information disclosure. This vulnerability appears as CVE-2026-76054. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability was found in Black Duck blackduck-c-cpp up to 3.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown code block of the component Build Capture/Signature Scanning. The manipulation of the argument BLACKDUCK_API_TOKEN/BD_HUB_TOKEN with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.

The advisory is shared at community.blackduck.com. This vulnerability is known as CVE-2026-76054 since 08/18/2026. The exploitation appears to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 3.0.7 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Black Duck

Name

• blackduck-c-cpp

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion