sealed-env CVE-2026-45091

Vulnerability affects ONLY sealed-env enterprise mode - basic mode installations are NOT vulnerable. Exploitation requires network-level observation of minted unseal tokens, which occurs in default deployments where tokens appear in: CI/CD pipeline logs (GitHub Actions, GitLab CI, Jenkins console output), container runtime environments (docker inspect, kubectl describe pod output), application performance monitoring integrations (Sentry breadcrumbs, Datadog traces), centralized logging aggregation (rsyslog, Fluentd forwarding), or error reporting platforms (Rollbar, Bugsnag stack traces). No authentication, user interaction, or special configuration required for exploitation once token observation occurs (CVSS PR:N/UI:N). Alpha version software (0.1.0-alpha.x) suggests limited production deployment, reducing real-world attack surface compared to stable releases. Exploitation limited to environments where: (a) enterprise mode is explicitly enabled, (b) unseal token generation occurs, and (c) tokens propagate to observable infrastructure.

Real-world risk is CRITICAL despite absence of confirmed exploitation. CVSS 9.1 accurately reflects severity: network-accessible (AV:N), low complexity (AC:L), no privileges or user interaction required (PR:N/UI:N), high confidentiality and integrity impact (C:H/I:H). Attack surface is extensive - tokens appear in CI/CD build logs (GitHub Actions, Jenkins), container orchestration outputs (kubectl describe pod, docker inspect), application monitoring platforms (Sentry, Rollbar, Datadog), centralized logging systems (Splunk, ELK), and error reporting tools. TOTP secret exposure enables persistent authentication bypass, not just one-time credential theft. No EPSS score available for this 2026 CVE, but exploitation requires only network observation and base64 decoding - trivially automatable with no specialized tools. Absence from CISA KEV likely reflects the library's alpha status and limited enterprise deployment rather than low exploitability. Organizations using alpha versions in production face immediate credential compromise risk. The scope is unchanged (S:U), meaning compromise remains within the vulnerable component, but extracted TOTP secrets grant lasting access to protected systems.

An attacker monitors a target organization's CI/CD pipeline outputs or gains read access to a centralized logging platform where sealed-env unseal tokens are recorded during application deployment. The attacker extracts a JWS token from build logs, decodes the base64 payload to reveal the embedded TOTP secret in plaintext JSON, and uses this secret to generate valid time-based authentication codes. With valid TOTP codes, the attacker authenticates as the operator to sealed-env protected systems, accessing encrypted secrets or administrative functions without further authorization challenges.