CVE-2026-45091

{
  "id": "CVE-2026-45091",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T14:17:08.820",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4."
    },
    {
      "lang": "es",
      "value": "sealed-env es una biblioteca de gestión de secretos de confianza cero y de pila cruzada para Node.js y Java/Spring Boot. En el modo empresarial de sealed-env, las versiones 0.1.0-alpha.1 a la 0.1.0-alpha.3 incrustaron el secreto TOTP literal del operador en la carga útil JWS de cada token de desprecintado emitido. La carga útil JWS es JSON codificado en base64, NO cifrado. Cualquier parte que pudiera observar un token emitido (registros de compilación de CI, volcados de entorno de contenedor, kubectl describe pod, rastreos de pila de Sentry/Rollbar, agregadores de registros) podría decodificar la carga útil y extraer el secreto TOTP en texto plano. Esta vulnerabilidad está corregida en la 0.1.0-alpha.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "davidalmeidac",
          "product": "sealed-env",
          "versions": [
            {
              "version": "< 0.1.0-alpha.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T14:38:56.109361Z",
          "id": "CVE-2026-45091",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv",
      "source": "[email protected]"
    }
  ]
}