Dashboard / CVE-2026-71863

CVE-2026-71863

LOW
INFO Priority: 0.01 BB Relevance: 30/100
Published: 2026-11-06 Modified: 2026-11-12 First seen: 2026-11-06 Status: active

Attack Surface

Network Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: Required
S: Changed
C: Low
I: None
A: None

Description

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
freedomofpress securedrop >= 2.13.0, < 2.16.1
freedomofpress securedrop >= 2.13.0, < 2.16.1

References & Advisories (3)

Bug Bounty Relevance

30 / 100
✓ Network accessible

CVSS Score

2.6 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

EPSS — Exploitation Probability

0.21%
Raw Score 0.002140
Percentile 11.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00214
2026-11-12
0.00214
2026-11-10
0.00214
2026-11-09
0.00214
2026-11-08
0.00214
2026-11-07
0.00214

Intelligence Sources

mitre ref →
nvd ref →

External Links