CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
The product uses an environment variable to store unencrypted sensitive information.
A kind of CWE-312 Cleartext Storage of Sensitive Information.
From the CWE List. © The MITRE Corporation.
Newest
- tinyhumansai openhuman OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive) 8.8 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 more pgAdmin 4: Server passwords are left in pgAdmin's process environment 7.0 High
- letta-ai letta Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance 7.1 High
- swe-agent mini-swe-agent mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment 6.0 Medium
- hmbown codewhale CodeWhale before 0.8.64 Environment Variable Leak via js_execution 8.7 High
- elastic cloud on kubernetes, eck operator +1 more Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure 6.5 Medium
- jetbrains teamcity In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters 4.3 Medium
- nousresearch hermes-agent NousResearch hermes-agent Environment Variable code_execution_tool.py execute_code sandbox 6.9 Medium
- universal-tool-calling-protocol python-utcp python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection 7.7 High
- mervinpraison praisonaiagents PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool 7.4 High
- ibm planning analytics advanced certified containers IBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerability 4.4 Medium
- ibm db2 recovery expert for luw, db2 recovery expert +1 more Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows 5.3 Medium
- mend renovate-ce, renovate-ee-server, renovate-ee-worker +1 more +3 more Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure 6.8 Medium
- ibm controller IBM Controller Information Disclosure 6.5 Medium
- keycloak, red hat build of keycloak 26.0, build of keycloak 26.2 +1 more +3 more Org.keycloak/keycloak-model-storage-service: variable injection into environment variables 4.9 Medium
- openc3 cosmos A credential leak in OpenC3 COSMOS v6.0.0 allows attackers to access service credentials as... 7.5 High
- mautic Mautic does not shield .env files from web traffic 5.1 Medium
- ibm storage virtualize vsphere remote plug-in, storage virtualize plugin for vsphere +1 more IBM Storage Virtualize vSphere Remote Plug-in information disclosure 6.8 Medium
- tapandsign technologies tap&sign app, tapandsign tap\&sign +1 more Improper Authentication in Tapandsign Technologies Tap and Sign App 6.5 Medium
- ibm mq IBM MQ information disclosure 5.5 Medium
- red hat build of keycloak, build of keycloak 26.0, jboss enterprise application platform 8 +2 more +4 more Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables 4.9 Medium
- red hat openshift container platform 4.14, openshift container platform 4.15 +1 more Cluster-image-registry-operator: exposes a secret via env variable in pod definition on azure 6.8 Medium
- red hat hawtio 4.0.0 for red hat build of apache camel 4, amq streams 2.7.0, build of apache camel 4 for quarkus 3 +9 more +11 more Quarkus-core: leak of local configuration properties into quarkus applications 7.0 High
- quarkus Quarkus: build env information disclosure via gradle plugin 7.7 High
- telit cinterion bgs5, ehs5, els61 +17 more +19 more A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists... 3.3 Low
- ericcornelissen shescape Shescape potential environment variable exposure on Windows with CMD 3.1 Low
- hashicorp nomad Hashicorp Nomad Information Exposure Through Environmental Variables 5.3 Medium
- ecava integraxor, integraxor scada server +1 more Ecava IntegraXor SCADA Server Information Exposure Through Environmental Variables 5.0