CVE-2026-76054
2026-08-24
15h16 +00:00
15h16 +00:00
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
CVE 설명
Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable.
Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.
CVE 정보
관련 약점
| 약점 이름 | 출처 | |
|---|---|---|
| Invocation of Process Using Visible Sensitive Information A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system. |
