Vulnerability in Freedomofpress Securedrop
CVE-2026-71863
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1.
Published .
CVSS v3 metric
CVSS v3 base score 2.6 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Freedomofpress Securedrop — versions >= 2.13.0, < 2.16.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-71863?
- CVE-2026-71863 is a low-severity vulnerability in Freedomofpress Securedrop, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 2.6/10. Published 2026-11-06.
- How severe is CVE-2026-71863?
- Low severity. CVSS v3 base score is 2.6 out of 10.