The vulnerability allows the copy operation in the securedrop-admin Ansible playbook to inadvertently transfer all files in the administrator’s configuration directory, including Onion Service client authentication credentials, to the Monitor Server when journalist alerts are disabled and the alert key filename is left empty. The exposed credentials provide an additional layer of confidentiality but are insufficient by themselves to compromise the Journalist Interface, which still requires a username, passphrase, and MFA, nor to bypass the SSH key-based access to the Monitor Server.

The affected vendor is freedomofpress:securedrop. Vulnerable versions are SecureDrop deployments using the 2.13.0 through 2.16.1 releases that were installed with the journalist alerts option turned off via the securedrop-admin playbook. The issue was addressed in release 2.16.1.

The CVSS score of 2.6 indicates low severity. EPSS is not available and the issue is not listed in the CISA KEV catalog, suggesting limited exploitation likelihood. An attacker must first compromise the Monitor Server to acquire the copied credentials; thus the attack vector requires prior server compromise and the foothold provided by the leaked files is a secondary benefit rather than a primary attack pathway. No public exploits are reported, and the impact is constrained to credential exposure if the Monitor Server is already compromised.