Invocation of a subprocess during the build process in Black Duck blackduck-c-cpp inherits the executing environment, allowing any code running in the build to read the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable. This leaks the API token, granting unauthorized access to the Black Duck system and potentially enabling further compromises. The weakness falls under CWE‑214, which concerns the disclosure of sensitive information via environment variables. The impact is primarily a confidentiality breach of the API token, with downstream effects that could expose the entire Black Duck instance or any services authenticated with that token.

Black Duck blackduck-c-cpp versions 1.0.17 through 3.0.6 when the API token is supplied via the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variable.

The CVSS score of 7.1 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. However, the attack requires the attacker to execute code within the build environment, which is typically accessible to developers or CI runners. When that condition is met, the sensitive token is revealed, enabling further downstream compromise. The lack of a KEV listing does not mitigate the risk of internal or supply‑chain attackers.