Whistleblower Submission System Vulnerability in SecureDrop by Freedom of the Press Foundation

CVE-2026-71863

What is CVE-2026-71863?

The SecureDrop platform, designed for secure whistleblower submissions, is susceptible to a configuration flaw that occurs when the secure admin install playbook is executed with journalist alerts disabled. This misconfiguration results in the journalist alert key filename being left empty, permitting the transfer of all files contained in the ~/.config/securedrop-admin/ directory to the Monitor Server. Notably, this includes critical Onion Service client authentication credentials. Although an attacker needs to first breach the privileged Monitor Server to exploit this vulnerability, the presence of these credentials still provides a limited access path. The Journalist Interface requires further authentication measures, including a username, passphrase, and multi-factor authentication (MFA), alongside SSH requiring key access for any potential breach. This issue was addressed in SecureDrop version 2.16.1.

References