PT-2026-40032 · Unknown · Sealed-Env

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-45091

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions sealed-env versions 0.1.0-alpha.1 through 0.1.0-alpha.3

Description In enterprise mode, the operator's literal TOTP (Time-based One-Time Password) secret is embedded in the JWS (JSON Web Signature) payload of every minted unseal token. Because the JWS payload is base64-encoded JSON and not encrypted, any party capable of observing a minted token—such as through CI build logs, container environment dumps, kubectl describe pod commands, Sentry or Rollbar stack traces, or log aggregators—can decode the payload to extract the TOTP secret in plaintext. This exposure allows an attacker possessing the master key and a leaked token to mint unlimited new unseal tokens indefinitely, bypassing second-factor protection.

Recommendations Update to version 0.1.0-alpha.4.

Fix

Insufficiently Protected Credentials

Information Disclosure

Weakness Enumeration

CWE-522

CWE-200

Related Identifiers

CVE-2026-45091

GHSA-X3R2-FJ3R-G5MV

Affected Products

Sealed-Env

References · 6

• https://osv.dev/vulnerability/GHSA-x3r2-fj3r-g5mv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45091 · Security Note
• https://github.com/davidalmeidac/sealed-env · Note
• https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv · Note
• https://t.me/CVEtracker/53514 · Telegram Post
• https://twitter.com/UpwindMDR/status/2054254919998173595 · Twitter Post