What is the CVSS score of CVE-2026-48295?

CVE-2026-48295 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Adobe C2PA SDK are affected by CVE-2026-48295?

Adobe's Content Credentials (C2PA) tooling-affecting Rust SDK versions ≤0.84.0, JavaScript SDK ≤0.7.0, and the c2patool command-line utility ≤0.16.5-exposes stored credentials and secrets to…

How to fix or mitigate CVE-2026-48295?

Within 24 hours, conduct an inventory of all systems running Rust SDK ≤0.84.0, @contentauth/c2pa-web ≤0.7.0, or c2patool ≤0.16.5 and immediately rotate any credentials, API keys, or signing secrets that may have been stored. Within 7 days, isolate affected systems behind network access controls, implement IP whitelisting to restrict remote access, and enable detailed logging to detect credential read attempts; consider disabling the tooling entirely if non-critical to operations. Within 30 days, establish a vendor notification process with Adobe to track patch availability, implement external secret management (HashiCorp Vault or AWS Secrets Manager) to eliminate embedded credential storage in future deployments, and rotate credentials again upon patch release.

Adobe C2PA SDK CVE-2026-48295

EUVD-2026-44528 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-07-14 psirt@adobe.com

GHSA-87gh-gwg6-px6x

Information Disclosure C2Pa C2Pa Web C2Patool

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Vendor states no user interaction and network-reachable credential disclosure with no auth, so AV:N/PR:N/UI:N; impact is read-only credential exposure, so C:H and I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:32 vuln.today

CVE Published

Jul 14, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attacker could leverage this vulnerability to gain unauthorized read access. Exploitation of this issue does not require user interaction.

AnalysisAI

Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS SDK (@contentauth/c2pa-web ≤0.7.0), and the c2patool command-line utility (≤0.16.5) - allows a remote attacker to gain unauthorized read access to sensitive credentials due to insufficient protection of stored secrets (CWE-522). The CVSS 3.1 vector (AV:N/PR:N/UI:N, C:H) rates it 7.5 High with no authentication or user interaction required. There is no public exploit identified at time of analysis, CISA SSVC lists exploitation as none, and EPSS is low at 0.39% (31st percentile), so no active exploitation is evidenced.

Technical ContextAI

C2PA (Coalition for Content Provenance and Authenticity) is an open standard for cryptographically signing and verifying the provenance of digital media, and Adobe's Content Authenticity Initiative (CAI) ships reference implementations: a Rust SDK (crate 'c2pa'), a Node.js/browser JS SDK ('@contentauth/c2pa-web'), and the 'c2patool' CLI, all confirmed via the CPE strings cpe:2.3:a:adobe:c2pa, c2pa-web, and c2patool. The root cause is CWE-522, Insufficiently Protected Credentials, meaning secret material (e.g. signing keys or credentials used in the provenance workflow) is stored or handled without adequate protection such as encryption or access restriction, permitting unauthorized read access. Because these are libraries/tools embedded in other applications, the exposure depends heavily on how a consuming application deploys and exposes the SDK.

RemediationAI

Upgrade to the vendor-released patched versions: Rust SDK c2pa-v0.85.2, JS SDK @contentauth/c2pa-web@0.9.0, and CLI c2patool-v0.26.65, per Adobe advisory APSB26-80 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html). Because these are dependencies, update the pinned version in your Cargo.toml / package.json and rebuild and redeploy any application or pipeline that embeds them, and rotate any credentials or signing keys that may have been exposed while the vulnerable version was in use, since a patch does not undo prior disclosure. If immediate upgrade is not possible, restrict network and process access to services that use the affected SDK and audit where credential material is stored, with the trade-off that this narrows exposure but does not remove the underlying insufficient protection.