CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable
variantThe product uses an environment variable to store unencrypted sensitive information.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (26)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-108592US | medium5.3 | Exploit | ||
mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host e… | ||||
| CVE-2026-75915US | high7.5 | — | ||
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spa… | ||||
| CVE-2023-5720US | high7.5 | — | ||
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an… | ||||
| CVE-2026-77938US | medium6.5 | — | ||
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full serv… | ||||
| CVE-2026-40153US | medium6.5 | — | ||
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument at line 64, man… | ||||
| CVE-2026-76227US | medium5.5 | — | ||
Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, reno… | ||||
| CVE-2023-47615US | medium5.5 | — | ||
A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit… | ||||
| CVE-2019-14802US | medium5.3 | — | ||
HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies… | ||||
| CVE-2014-2377US | medium5.0 | — | ||
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag. | ||||
| CVE-2025-36105US | medium4.4OT elevated | — | ||
IBM Planning Analytics Advanced Certified Containers 3.1.0 through 3.1.4 could allow a local privileged user to obtain sensitive information from environment variables. | ||||
| CVE-2023-35931US | medium4.3 | — | ||
Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.
| ||||
| CVE-2026-72648US | — | — | ||
Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure via Retrieve Embedded Sensit… | ||||
| CVE-2026-49377US | — | — | ||
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters | ||||
| CVE-2026-9368US | — | — | ||
A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Enviro… | ||||
| CVE-2026-45370US | — | — | ||
python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess.… | ||||
| CVE-2025-27899US | — | — | ||
IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 discloses sensitive information in an environment variable that could aid in further attacks against the system. | ||||
| CVE-2025-36017US | — | — | ||
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obta… | ||||
| CVE-2025-9162US | — | — | ||
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially refer… | ||||
| CVE-2025-28381US | — | — | ||
A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers. | ||||
| CVE-2024-47056US | —OT elevated | — | ||
SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This exposure could lead to… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan