CVE-2021-41077

7.5 HIGH

The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that...

Published: 2021-09-14 · Last updated: 2026-06-17

Severity and scoring

CVSS: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-862

Affected products

Vendor	Product
travis-ci	travis_ci

Description

The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is not specified by the customer-controlled .travis.yml file. In particular, the desired behavior (if .travis.yml has been created locally by a customer, and added to git) is for a Travis service to perform builds in a way that prevents public access to customer-specific secret environment data such as signing keys, access credentials, and API tokens. However, during the stated 8-day interval, secret data could be revealed to an unauthorized actor who forked a public repository and printed files during a build process.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-41077
[Vendor advisory]https://blog.travis-ci.com/2021-09-13-bulletin
[Other]https://news.ycombinator.com/item?id=28523350
[Other]https://news.ycombinator.com/item?id=28524727
[Vendor advisory]https://travis-ci.community/t/security-bulletin/12081
[Other]https://twitter.com/peter_szilagyi/status/1437646118700175360
[Other]https://twitter.com/peter_szilagyi/status/1437649838477283330
[Vendor advisory]https://blog.travis-ci.com/2021-09-13-bulletin
[Other]https://news.ycombinator.com/item?id=28523350
[Other]https://news.ycombinator.com/item?id=28524727
[Vendor advisory]https://travis-ci.community/t/security-bulletin/12081
[Other]https://twitter.com/peter_szilagyi/status/1437646118700175360
[Other]https://twitter.com/peter_szilagyi/status/1437649838477283330

Related CVEs

Same CWE

CVE-2026-12105 — Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplicat...
CVE-2026-53866 — OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators ... (8.1 HIGH)
CVE-2026-53851 — OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite... (5.3 MEDIUM)
CVE-2026-53850 — OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated caller... (5.5 MEDIUM)
CVE-2026-53844 — OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated call... (6.5 MEDIUM)