CVE-2026-74873

When a CLI application accepts `--password` as a command-line argument, that password becomes visible to every user on the system through `/proc/<pid>/cmdline` or the `ps` command. This isn't a theoretical exposure — it's immediate and complete for any user with local access, including in containerized environments, shared shells, and CI runners. CVE-2026-74873 represents this exact flaw in a library that chose to preserve the dangerous `--password` flag as 'deprecated but functional' rather than removing it entirely. The practical impact: any multi-user system, any shared hosting environment, any container where other processes might inspect the parent's command line, and any CI system that logs commands all become de facto exposure vectors. The CVSS 5.5 rating ('Authorization Bypass Through User-Controlled Key' with AV:L/AC:L/PR:N/UI:N) reflects a single-user attack model that doesn't match production reality. What you should check and do: First, audit every CLI tool, library wrapper, and automation script in your environment for `--password`, `-p`, or equivalent flags that accept secrets as positional arguments. Search your codebase for patterns like `argparse.password()` or libraries that expose password-from-argument options. Second, verify whether your current tools actually use interactive password prompting, secret file references (e.g., `--password-file`), or environment variable integration — and whether those alternatives properly mask their values in process listings. Third, if you find the pattern, treat it as a hard dependency issue: upgrade to a version that removes the dangerous API entirely, not one that merely warns against it. A 'deprecated but functional' flag is not a fix — it's security theater that passes for remediation. Fourth, for any automation that genuinely requires non-interactive secret injection, implement a secret manager integration or file-based secret loading with restrictive permissions, and accept that this is a harder but necessary path. The vulnerability persists because the dangerous path remains the path of least resistance — your goal is to make it the path of greatest resistance.

Reviewed through automated stages and approved by a human before publication.