Sealed Env
Approved changes feed: RSS · Atom
cpe:2.3:a:davidalmeidac:sealed-env:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Davidalmeidac (51d399a1-0a00-5cc9-83ac-a3ed73b5e0f8) |
|---|---|
| Product | Sealed Env (7c18cae7-2b12-519d-9077-efa6d8c5abd5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-45091 |
vulnerable | 2026-06-08 08:05:11.461250 |
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
CRITICAL (9.1)
sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.
Published: 2026-05-12T13:20:21.560Z
Updated: 2026-05-12T14:39:10.904Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.