How severe is CVE-2026-76054?

CVE-2026-76054 has a CVSS 4.0 base score of 7.1, rated high severity.

Is CVE-2026-76054 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-76054?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-76054 published?

CVE-2026-76054 was published on 2026-08-24 and last updated on 2026-09-01.

CVE-2026-76054

CVE-2026-76054 is a high-severity vulnerability with a CVSS 4.0 base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-214.

Key facts

Severity: High (CVSS 4.0 base score 7.1)
EPSS exploit prediction: 0% (4th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-214
Published: 2026-08-24
Last modified: 2026-09-01

Description

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.

Frequently asked questions

What is CVE-2026-76054?: Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.
How severe is CVE-2026-76054?: CVE-2026-76054 has a CVSS 4.0 base score of 7.1, rated high severity.
Is CVE-2026-76054 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-76054?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-76054 published?: CVE-2026-76054 was published on 2026-08-24 and last updated on 2026-09-01.

References

Other CWE-214 vulnerabilities

CVE-2026-12250 — High (CVSS 7.9): Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies…
CVE-2020-36771 — High (CVSS 7.8): CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations…
CVE-2021-3859 — High (CVSS 7.5): A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This…
CVE-2024-4254 — High (CVSS 7.1): The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable…
CVE-2025-5452 — Medium (CVSS 6.6): A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP…
CVE-2026-61670 — Medium (CVSS 6.5): microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs…

Browse all CWE-214 vulnerabilities →