Executive brief
Black Duck's C/C++ scanner, used to identify security vulnerabilities in open-source code, exposes API authentication tokens in the environment when executing build processes. An attacker who can execute code during a project build can steal the Black Duck API token, gaining unauthorized access to the organization's vulnerability intelligence and scan data. Organizations using environment variables to supply credentials must rotate any tokens previously used with affected versions.
Technical details
The vulnerability is an instance of CWE-95 (Invocation of Process Using Visible Sensitive Information), where the Black Duck C/C++ scanner inherits authentication tokens from parent process environment variables when launching subprocesses during build capture and signature scanning. Specifically, the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variables are passed to child processes without sanitization. An attacker with code execution privileges within a scanned project's build can read the process environment of spawned scanner subprocesses to extract the API token. This vulnerability affects versions 1.0.17 through 3.0.6. No CVSS score was published, and there is no indication of active exploitation. Affected organizations should rotate any API tokens that were supplied via environment variables to affected versions.
Affected products
- Synopsys Black Duck C/C++ scanner 1.0.17 through 3.0.6
Timeline
- 2026-08-24: disclosed