CVE-2026-76054: Black Duck blackduck-c-cpp vulnerability
Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched during build capture and signature scanning. This applies only where the token is supplied through the BLACKDUCKAPITOKEN or BDHUBTOKEN environment variable.
Upgrading does not remediate prior disclosure; any token supplied to an affected version through an environment variable should be rotated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Rotate any Black Duck API token that was supplied to an affected Black Duck blackduck-c-cpp version (1.0.17 through 3.0.6) via the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable, since upgrading does not remediate prior disclosure.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using blackduck-c-cpp versions 1.0.17 through 3.0.6 are exposed only if the Black Duck API token is provided through the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. An attacker must be able to execute code within the scanned project's build.
How could an attacker obtain the token?
Build capture and signature-scanning subprocesses inherit the ambient process environment. Code executed during the scanned project's build can read the inherited BLACKDUCK_API_TOKEN or BD_HUB_TOKEN value.
What should be done if an affected version has already been used with an environment-supplied token?
Rotate any Black Duck API token that was supplied to an affected version through BLACKDUCK_API_TOKEN or BD_HUB_TOKEN. Upgrading alone does not remediate a token that may already have been disclosed.