---
id: "CVE-2026-71863"
page: "https://infrastack.ai/live/CVE-2026-71863"
kind: "vulnerability"
aliases: ["CVE-2026-71863"]
title: "SecureDrop: installer copies Onion client credentials to Monitor Server"
severity: "low"
cvss: 2.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["onion-service", "other", "securedrop", "self-hosted"]
not_affected_if: ["journalist-alerts-enabled", "outside-affected-range"]
published_at: "2026-11-06T21:17:10+00:00"
first_seen_at: "2026-11-06T21:45:08+00:00"
updated_at: "2026-11-06T21:46:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71863", "first_seen_at": "2026-11-06T21:45:08+00:00"}]
exploit_sources: []
---

# SecureDrop: installer copies Onion client credentials to Monitor Server

Link for people: https://infrastack.ai/live/CVE-2026-71863 (this .md is for agents)

When journalist alerts are disabled, the SecureDrop installer copies every file in its config folder, including Onion Service client authentication credentials, to the Monitor Server. An attacker who has already compromised the Monitor Server could use those credentials, though they are not enough to log in alone.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SecureDrop version in the admin workstation's securedrop-admin output or release tag; affected range is `2.13.0` through `2.16.1`.
- Check whether journalist alerts are disabled in the SecureDrop configuration.

## Fix

- Upgrade SecureDrop to `2.16.1`.

## Timeline

- 2026-11-06T21:45:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-71863

## Documents

- [advisory] Vendor advisory: github.com https://github.com/freedomofpress/securedrop/security/advisories/GHSA-rqwh-4873-322p
- [fix] Patch: github.com https://github.com/freedomofpress/securedrop/commit/8947b8a69e0d13d2a0fa9f0082ecc2a28428cf4c
- [fix] Release notes: github.com https://github.com/freedomofpress/securedrop/releases/tag/2.16.1

## From the sources

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_