Vulnerability · Published Aug 24, 2026 · Assigned by BlackDuck

CVE-2026-76054

High 7.1

In plain English

A high-severity security flaw in blackduck-c-cpp from Black Duck. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 92.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.

Affected products (as reported)

Vendor	Product	Versions
Black Duck	blackduck-c-cpp	1.0.17 – before 3.0.7

Weakness: CWE-214 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L

References

Black Duck Product Security Advisory vendor-advisory
blackduck-c-cpp on PyPI product