CVE-2026-45091 Details
Description
sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.
A vulnerability in the sealed-env library, affecting versions 0.1.0-alpha.1 through 0.1.0-alpha.3, allows the operator's TOTP secret to be embedded in the JWS payload of unseal tokens. This payload, which is base64-encoded JSON and not encrypted, could be decoded by any party observing the token. The vulnerability arises in enterprise mode, where the exposed TOTP secret could be extracted and used to mint new unseal tokens, undermining the library's claimed second-factor authentication. The issue has been patched in version 0.1.0-alpha.4 by replacing the embedded secret with a salt-bound HMAC derivative, ensuring that the TOTP secret never leaves the operator's machine.
Users should upgrade to sealed-env version 0.1.0-alpha.4 or later. Files sealed by affected versions must be re-sealed and the TOTP secret rotated. A full migration playbook is available in the CHANGELOG.md.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/davidalmeidac/sealed-env/security/advisories/GHSA-x3r2-fj3r-g5mv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sealed-env | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |