CVE-2026-71863 · Other
NO FIX YET · SEE WHAT TO DO
When journalist alerts are disabled, the SecureDrop installer copies every file in its config folder, including Onion Service client authentication credentials, to the Monitor Server. An attacker who has already compromised the Monitor Server could use those credentials, though they are not enough to log in alone.
first public Jul 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Media organizations and others who run SecureDrop from versions 2.13.0 through 2.16.1 with journalist alerts disabled. Installations on other versions, or with alerts enabled, are not described as affected.
Not affected if journalist-alerts-enabled, outside-affected-range
Who cares onion-service, securedrop, self-hosted
2.13.0 through 2.16.1.2.16.1.SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.