CVE-2026-45091
Description
sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.
How to fix
- sealed-env0.1.0-alpha.4 or later
- io.github.davidalmeidac:sealed-env-core0.1.0-alpha.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sealed-envnpm | v < 0.1.0-alpha.4 | 0.1.0-alpha.4 |
| io.github.davidalmeidac:sealed-env-coreMaven | v < 0.1.0-alpha.4 | 0.1.0-alpha.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.