Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-71863— SecureDrop: Onion Service client auth credentials copied to Monitor Server

Quick assessment

Affected
freedomofpress securedrop
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SecureDrop 是一个开源的吹哨人提交系统，媒体组织可借此安全地接收来自匿名信源的文档并与之通信。在 2.13.0 至 2.16.1 版本期间，若在禁用记者警报（journalist alerts）的情况下运行 securedrop-admin 的 Ansible 安装剧本，会导致记者警报密钥文件名留空，进而使复制任务将 ~/.config/securedrop-admin/ 目录中的所有文件（包括洋葱服务客户端身份验证凭证）传输至监控服务器。攻击者必须先入侵拥有高权限的监控服务器才能获取这些凭证；且这些凭证

CVSS 2.6 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-71863

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SecureDrop: Onion Service client auth credentials copied to Monitor Server
Source: CVE Program / CVE List V5
Vulnerability Description
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过发送数据的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
freedomofpress securedrop >= 2.13.0, < 2.16.1 -

II. Public POCs for CVE-2026-71863

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-71863

请登录查看更多情报信息。

Other References for CVE-2026-71863 (3)

IV. Related Vulnerabilities

Same product: securedrop
Same vendor: freedomofpress
Same weakness: CWE-201