{"id":"CVE-2026-71863","kind":"vulnerability","aliases":["CVE-2026-71863"],"related":[],"title":"SecureDrop: installer copies Onion client credentials to Monitor Server","description":"SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1.","summary":"When journalist alerts are disabled, the SecureDrop installer copies every file in its config folder, including Onion Service client authentication credentials, to the Monitor Server. An attacker who has already compromised the Monitor Server could use those credentials, though they are not enough to log in alone.","severity":"low","cvss":2.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["onion-service","other","securedrop","self-hosted"],"not_affected_if":["journalist-alerts-enabled","outside-affected-range"],"how_to_check":"- Check the installed SecureDrop version in the admin workstation's securedrop-admin output or release tag; affected range is `2.13.0` through `2.16.1`.\n- Check whether journalist alerts are disabled in the SecureDrop configuration.","fix":"- Upgrade SecureDrop to `2.16.1`.","status":"open","published_at":"2026-11-06T21:17:10+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","triaged_at":"2026-11-06T21:46:52+00:00","updated_at":"2026-11-06T21:46:52+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-06T21:46:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SecureDrop to `2.16.1`.","reach":"network","title":"SecureDrop: installer copies Onion client credentials to Monitor Server","impact":"low","summary":"When journalist alerts are disabled, the SecureDrop installer copies every file in its config folder, including Onion Service client authentication credentials, to the Monitor Server. An attacker who has already compromised the Monitor Server could use those credentials, though they are not enough to log in alone.","audience":"businesses","category":"other","nicknames":[],"who_cares":["securedrop","self-hosted","onion-service"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Onion client credentials leak from the Monitor Server to an attacker already inside it","analyst_note":"","how_to_check":"- Check the installed SecureDrop version in the admin workstation's securedrop-admin output or release tag; affected range is `2.13.0` through `2.16.1`.\n- Check whether journalist alerts are disabled in the SecureDrop configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["journalist-alerts-enabled","outside-affected-range"],"who_is_affected":"Media organizations and others who run SecureDrop from versions 2.13.0 through 2.16.1 with journalist alerts disabled. Installations on other versions, or with alerts enabled, are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000706,"input_tokens":4426,"output_tokens":527,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-71863':12A,15A '/.config/securedrop-admin':127C '2.13.0':96C '2.16.1':98C,189C 'accept':87C 'access':162C,178C 'addit':156C 'admin':103C 'alert':26B,109C,114C 'alon':70B 'alreadi':53B 'anonym':93C 'ansibl':105C 'attack':50B,139C 'authent':43B,132C 'caus':118C 'client':5A,42B,131C 'communic':91C 'compromis':54B,142C 'config':37B 'copi':3A,32B,120C 'could':58B 'credenti':6A,44B,61B,133C,150C,153C 'cve':10A,13A 'disabl':28B,110C 'document':88C 'empti':117C 'enough':66B 'everi':33B,124C 'file':34B,125C 'filenam':116C 'first':141C 'fix':186C 'folder':38B 'host':23B 'includ':39B,128C 'instal':2A,31B,104C 'interfac':168C 'issu':184C 'journalist':25B,108C,113C,167C 'key':115C,182C 'layer':158C 'leav':111C 'log':68B 'media':81C 'mfa':175C 'monitor':8A,47B,56B,136C,145C 'must':140C 'obtain':148C 'onion':4A,17B,40B,129C 'onion-servic':16B 'open':75C 'open-sourc':74C 'organ':82C 'passphras':173C 'playbook':106C 'privileg':144C 'protect':157C 'rather':159C 'remain':154C 'requir':170C,180C 'run':99C 'secur':86C 'securedrop':1A,20B,30B,71C,102C 'securedrop-admin':101C 'self':22B 'self-host':21B 'server':9A,48B,57B,137C,146C 'servic':18B,41B,130C 'sourc':76C,94C 'ssh':177C,181C 'still':169C,179C 'submiss':78C 'suffici':161C 'system':79C 'task':121C 'though':62B 'transfer':123C 'use':59B,84C 'usernam':172C 'version':188C 'whistleblow':77C","nicknames":[],"mitigations":[],"who_affected":"Media organizations and others who run SecureDrop from versions 2.13.0 through 2.16.1 with journalist alerts disabled. Installations on other versions, or with alerts enabled, are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","onionservice","other","securedrop","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-71863':12A,15A 'client':5A 'copi':3A 'credenti':6A 'cve':10A,13A 'instal':2A 'monitor':8A 'onion':4A 'securedrop':1A 'server':9A","search_b":"'alert':26B 'alon':70B 'alreadi':53B 'attack':50B 'authent':43B 'client':42B 'compromis':54B 'config':37B 'copi':32B 'could':58B 'credenti':44B,61B 'disabl':28B 'enough':66B 'everi':33B 'file':34B 'folder':38B 'host':23B 'includ':39B 'instal':31B 'journalist':25B 'log':68B 'monitor':47B,56B 'onion':17B,40B 'onion-servic':16B 'securedrop':20B,30B 'self':22B 'self-host':21B 'server':48B,57B 'servic':18B,41B 'though':62B 'use':59B","search_c":"'/.config/securedrop-admin':127C '2.13.0':96C '2.16.1':98C,189C 'accept':87C 'access':162C,178C 'addit':156C 'admin':103C 'alert':109C,114C 'anonym':93C 'ansibl':105C 'attack':139C 'authent':132C 'caus':118C 'client':131C 'communic':91C 'compromis':142C 'copi':120C 'credenti':133C,150C,153C 'disabl':110C 'document':88C 'empti':117C 'everi':124C 'file':125C 'filenam':116C 'first':141C 'fix':186C 'includ':128C 'instal':104C 'interfac':168C 'issu':184C 'journalist':108C,113C,167C 'key':115C,182C 'layer':158C 'leav':111C 'media':81C 'mfa':175C 'monitor':136C,145C 'must':140C 'obtain':148C 'onion':129C 'open':75C 'open-sourc':74C 'organ':82C 'passphras':173C 'playbook':106C 'privileg':144C 'protect':157C 'rather':159C 'remain':154C 'requir':170C,180C 'run':99C 'secur':86C 'securedrop':71C,102C 'securedrop-admin':101C 'server':137C,146C 'servic':130C 'sourc':76C,94C 'ssh':177C,181C 'still':169C,179C 'submiss':78C 'suffici':161C 'system':79C 'task':121C 'transfer':123C 'use':84C 'usernam':172C 'version':188C 'whistleblow':77C","first_public_at":"2026-07-08T17:02:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71863","severity":null,"published_at":"2026-11-06T21:17:10+00:00","modified_at":"2026-11-06T21:17:10+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","fetched_at":"2026-11-06T21:45:08+00:00","note":null}],"documents":[{"id":90340,"url":"https://github.com/freedomofpress/securedrop/commit/8947b8a69e0d13d2a0fa9f0082ecc2a28428cf4c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90341,"url":"https://github.com/freedomofpress/securedrop/releases/tag/2.16.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90342,"url":"https://github.com/freedomofpress/securedrop/security/advisories/GHSA-rqwh-4873-322p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-08T17:02:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}