CVE-2026-76054: CWE-214 Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp

The vulnerability involves invocation of processes using visible sensitive information (CWE-214) in Black Duck blackduck-c-cpp from versions 1.0.17 up to but not including 3.0.7. An attacker able to execute code within the build environment can obtain the Black Duck API token because it is passed through environment variables that subprocesses inherit during build capture and signature scanning. This exposure risks unauthorized access to the Black Duck API. The vulnerability is rated with a CVSS 4.0 score of 7.1 (high severity) with local attack vector, low attack complexity, and partial attack type. No official patch or remediation level is stated, but upgrading to 3.0.7 or later is implied to fix the issue. Tokens exposed prior to upgrade should be rotated.

An attacker with the ability to execute code in the build environment can obtain sensitive API tokens used for Black Duck authentication. This could lead to unauthorized access to Black Duck services or data. The vulnerability does not allow remote exploitation without local code execution and requires the token to be supplied via environment variables. There are no known exploits in the wild at this time.

Upgrade blackduck-c-cpp to version 3.0.7 or later to remediate the vulnerability. Since upgrading does not mitigate any prior token exposure, any API tokens supplied through environment variables to affected versions should be rotated immediately. No other official remediation or temporary fixes are documented.