SynopsysCVE-2026-76054
Synopsys blackduck-c-cpp: information disclosure
High7.1CVE-2026-76054 · Published Aug 24, 2026 · updated Sep 1, 2026
Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| blackduck-c-cpp Product | >= 1.0.17, < 3.0.7 | 3.0.7 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-214
More Synopsys advisories
All Synopsys| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 24 | Synopsys blackduck-c-cpp: command injection | High7.5 | 3.0.7 |
| Jul 29 | Synopsys Coverity Connect: authentication bypass | Critical9.2 | 2026.6.0 |
| Jul 29 | Synopsys Coverity Connect: SQL injection | High8.7 | 2026.6.0 |