Common Weakness Enumeration

CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable

Description

The product uses an environment variable to store unencrypted sensitive information.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-526 ordered by modification date.

12 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-h539-c7r8-3xq4	CVE-2026-75915	HIGH	npm/codewhale npm/deepseek-tui	CodeWhale: js_execution leaks parent environment to model context via missing env scrub	2026-09-04
GHSA-wm96-9gfh-vvgq	CVE-2026-9368	MODERATE	pypi/hermes-agent	hermes-agent has a sandbox issue	2026-06-30
GHSA-5v57-8rxj-3p2r	CVE-2026-45370	HIGH	pypi/utcp-cli	python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection	2026-05-15
GHSA-v8g7-9q6v-p3x8	CVE-2026-40153	HIGH	pypi/praisonaiagents	PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool	2026-04-10
GHSA-8hxp-qmph-w5gq	CVE-2025-9162	MODERATE	maven/org.keycloak/keycloak-model-storage-services	Keycloak Potential Variable Reference in Model Storage Services	2025-10-10
GHSA-w2wj-hw98-233h	-	MODERATE	maven/org.keycloak/keycloak-model-storage-services	Duplicate Advisory: Keycloak Potential Variable Reference in Model Storage Services	2025-10-08
GHSA-h2wg-v8wg-jhxh	CVE-2024-47056	MODERATE	-	Mautic does not shield .env files from web traffic	2025-05-28
GHSA-f4v7-3mww-9gc2	CVE-2024-11736	MODERATE	maven/org.keycloak/keycloak-quarkus-server	Keycloak allows unrestricted admin use of system and environment variables	2025-01-14
GHSA-f8h5-v2vg-46rr	CVE-2024-2700	HIGH	maven/io.quarkus/quarkus-core	quarkus-core leaks local environment variables from Quarkus namespace during application's build	2024-12-13
GHSA-p62q-5483-h57v	CVE-2023-5720	HIGH	maven/io.quarkus/quarkus-project	Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain	2023-11-15
GHSA-3g7p-8qhx-mc8r	CVE-2023-35931	LOW	npm/shescape	Shescape potential environment variable exposure on Windows with CMD	2023-06-26
GHSA-6hv3-7c34-4hx8	CVE-2019-14802	MODERATE	golang/github.com/hashicorp/nomad	Hashicorp Nomad Information Exposure Through Environmental Variables	2023-04-17