CVE-2026-45091: sealed-env Enterprise Mode: TOTP Secret Exposed in Unseal Token Payload

Overview

CVE-2026-45091 is classified under CWE-200 (Exposure of Sensitive Information). According to the record, the enterprise mode of sealed-env embedded the operator's literal TOTP secret in the payload of every minted unseal token in versions 0.1.0-alpha.1 through 0.1.0-alpha.3. The payload is base64-encoded JSON and is not encrypted, so the secret is readable by anyone who obtains a token.

Impact

The GitHub CNA scored this CVE 9.1 under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low complexity, no privileges and no user interaction required, with high confidentiality and integrity impact.

The exposed value is the TOTP secret, which the record describes as the operator's literal secret.
The record lists places where tokens could be observed: CI build logs, container environment dumps, pod description output in Kubernetes, error tracking stack traces, and log aggregators.
Because the secret is exposed in clear text, any second factor relying on it may be weakened for as long as the secret remains unchanged.

Affected products and versions

The record identifies sealed-env enterprise mode as affected in versions 0.1.0-alpha.1 through 0.1.0-alpha.3. The structured affected and fixes fields in the record are empty, so the range above comes from the description text only.

Affected: 0.1.0-alpha.1 to 0.1.0-alpha.3 (enterprise mode, per the description).
Fixed: 0.1.0-alpha.4, as stated in the description.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability recorded is 0.00404 with a percentile of 0.32855, which estimates likelihood of exploitation activity but does not confirm it.

Remediation and mitigation

Upgrade sealed-env to version 0.1.0-alpha.4 or later, as stated in the record.
If an affected version was used in enterprise mode, treat the TOTP secret as potentially exposed and consider rotating it after upgrading, a step the record does not explicitly prescribe.
Review where unseal tokens minted by affected versions may have been stored or transmitted, such as build logs and container configuration, and restrict access to those locations.

See the GitHub Security Advisory GHSA-x3r2-fj3r-g5mv for vendor details.

Detection guidance

Search CI build logs, container environment captures, and centralized log stores for unseal tokens minted during the affected period.
Review error tracking tools for captured payloads that include authentication-related material.
Confirm the deployed sealed-env version in each environment and identify any running 0.1.0-alpha.1 to 0.1.0-alpha.3 builds in enterprise mode.

Limitations of the available information

The record has no structured affected or fixed version data, no KEV entry, and a deferred source status. Its details come from the description and one GitHub advisory reference. Whether any token was actually observed by a third party is unknown from the sources consulted.

Frequently asked questions

What is the core problem in CVE-2026-45091?

In enterprise mode, sealed-env versions 0.1.0-alpha.1 through 0.1.0-alpha.3 included the operator's literal TOTP secret in the payload of unseal tokens. The payload is base64-encoded, not encrypted, so anyone who sees a token can read the secret.

Which version fixes the issue?

The record states the vulnerability is fixed in 0.1.0-alpha.4. The structured fixes field is empty, so this comes from the description only.

Is this CVE known to be actively exploited?

No. The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.