---
id: CVE-2026-71863
title: 'SecureDrop: Onion Service client auth credentials copied to Monitor Server'
summary: >-
  SecureDrop is an open-source whistleblower submission system that media
  organizations can use to securely accept documents from, and communicate with
  anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin
  install Ansib…
severity: low
cvss: 2.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-201
vendor: freedomofpress
product: securedrop
affected:
  - 'securedrop >= 2.13.0, < 2.16.1'
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T20:58:10.211Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-71863'
references:
  - url: >-
      https://github.com/freedomofpress/securedrop/security/advisories/GHSA-rqwh-4873-322p
    label: >-
      https://github.com/freedomofpress/securedrop/security/advisories/GHSA-rqwh-4873-322p
  - url: >-
      https://github.com/freedomofpress/securedrop/commit/8947b8a69e0d13d2a0fa9f0082ecc2a28428cf4c
    label: >-
      https://github.com/freedomofpress/securedrop/commit/8947b8a69e0d13d2a0fa9f0082ecc2a28428cf4c
  - url: 'https://github.com/freedomofpress/securedrop/releases/tag/2.16.1'
    label: 'https://github.com/freedomofpress/securedrop/releases/tag/2.16.1'
tags:
  - cve.org
ingestedAt: '2026-11-06T22:04:56.349Z'
epss: 0.00214
epssPercentile: 0.11862
---

## Overview

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1.

## Affected

- `securedrop >= 2.13.0, < 2.16.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.