CVE-2026-76054
HighCVSS 7.1Summary
Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable.
Risk Assessment
Exposure of the API token may allow an attacker unauthorized access to Black Duck resources, including project data and configuration, potentially leading to confidentiality and integrity breaches.
Recommendation
Update blackduck-c-cpp to version 3.0.7 or later, and rotate any API tokens that were supplied via environment variables in affected versions.
Other vulnerabilities in Black Duck blackduck-c-cpp
Original NVD description (English source)
Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.