CVE-2026-45091

sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) sealed-env es una biblioteca de gestión de secretos de confianza cero y de pila cruzada para Node.js y Java/Spring Boot. En el modo empresarial de sealed-env, las versiones 0.1.0-alpha.1 a la 0.1.0-alpha.3 incrustaron el secreto TOTP literal del operador en la carga útil JWS de cada token de desprecintado emitido. La carga útil JWS es JSON codificado en base64, NO cifrado. Cualquier parte que pudiera observar un token emitido (registros de compilación de CI, volcados de entorno de contenedor, kubectl describe pod, rastreos de pila de Sentry/Rollbar, agregadores de registros) podría decodificar la carga útil y extraer el secreto TOTP en texto plano. Esta vulnerabilidad está corregida en la 0.1.0-alpha.4.

Information

Published : 2026-05-12 14:17

Updated : 2026-10-26 18:10

NVD link : CVE-2026-45091

Mitre link : CVE-2026-45091

CVE.ORG link : CVE-2026-45091

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-45091", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45091", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-12T14:38:56.109361Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "davidalmeidac", "product": "sealed-env", "versions": [{"status": "affected", "version": "< 0.1.0-alpha.4"}]}]}], "published": "2026-05-12T14:17:08.820", "references": [{"url": "https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4."}, {"lang": "es", "value": "sealed-env es una biblioteca de gesti\u00f3n de secretos de confianza cero y de pila cruzada para Node.js y Java/Spring Boot. En el modo empresarial de sealed-env, las versiones 0.1.0-alpha.1 a la 0.1.0-alpha.3 incrustaron el secreto TOTP literal del operador en la carga \u00fatil JWS de cada token de desprecintado emitido. La carga \u00fatil JWS es JSON codificado en base64, NO cifrado. Cualquier parte que pudiera observar un token emitido (registros de compilaci\u00f3n de CI, volcados de entorno de contenedor, kubectl describe pod, rastreos de pila de Sentry/Rollbar, agregadores de registros) podr\u00eda decodificar la carga \u00fatil y extraer el secreto TOTP en texto plano. Esta vulnerabilidad est\u00e1 corregida en la 0.1.0-alpha.4."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "security-advisories@github.com"}