CWE-526.

OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)

• tinyhumansai openhuman
• Broken access control
• CWE-526

pgAdmin 4: Server passwords are left in pgAdmin's process environment

• pgadmin.org pgAdmin 4
• CWE-214
• CWE-526

Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance

• letta
• CWE-526

mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment

• mini-swe-agent
• CWE-526

CodeWhale: js_execution leaks parent environment to model context via missing env scrub

• Information disclosure
• CWE-526

>=0.8.41, <0.8.64 · fixed in 0.8.64

Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure

• Elastic Eck Operator
• CWE-526

In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters

• JetBrains TeamCity
• CWE-526

hermes-agent has a sandbox issue

• Privilege escalation
• CWE-264

<0.11.0 · fixed in 0.11.0

python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

• CWE-526

<1.1.2 · fixed in 1.1.2

PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool

• CWE-526

<1.5.128 · fixed in 1.5.128

IBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerability

• IBM Planning Analytics Advanced Certified Containers
• CWE-526

Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows

• IBM DB2 Recovery Expert for LUW
• CWE-526

Child processes spawned by Renovate incorrectly have full access to environment variables

• Privilege escalation
• CWE-526

>=42.68.1, <42.96.3 || >=43.0.0, <43.4.4 · fixed in 42.96.3, 43.4.4

IBM Controller Information Disclosure

• IBM Controller
• CWE-526

Keycloak Potential Variable Reference in Model Storage Services

• CWE-526

* || >=26.3.0, <26.3.4 · fixed in 26.3.4

Duplicate Advisory: Keycloak Potential Variable Reference in Model Storage Services

• CWE-526

<=26.3.3 · no fixed version yet

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.

• CWE-526

<=6.0.0 · no fixed version yet

Mautic does not shield .env files from web traffic

• Information disclosure
• CWE-526

>=4.4.0, <4.4.16 || >=5.0.0-alpha, <5.2.6 || >=6.0.0-alpha, <6.0.2 · fixed in 4.4.16, 5.2.6, 6.0.2

IBM Storage Virtualize vSphere Remote Plug-in information disclosure

• IBM Storage Virtualize vSphere Remote Plug-in
• CWE-526

Improper Authentication in Tapandsign Technologies Tap and Sign App

• Tapandsign Technologies Tap&Sign App
• CWE-526
• CWE-640

IBM MQ information disclosure

• IBM MQ
• CWE-526

Keycloak allows unrestricted admin use of system and environment variables

• CWE-526

<26.0.8 · fixed in 26.0.8

Cluster-image-registry-operator: exposes a secret via env variable in pod definition on azure

• Red Hat OpenShift Container Platform 4.14
• Red Hat OpenShift Container Platform 4.15
• CWE-526

quarkus-core leaks local environment variables from Quarkus namespace during application's build

• CWE-526

>=3.9.0.CR1, <3.9.2 || >=3.3.0.CR1, <3.8.4 || <3.2.12.Final · fixed in 3.9.2, 3.8.4, 3.2.12.Final

Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain

• CWE-526

>=3.0.0.CR1, <=3.5.1 · no fixed version yet

Telit Cinterion BGS5: A CWE-526: Exposure of Sensitive Information Through Environmental Variables…

• Telit Cinterion BGS5
• Telit Cinterion EHS5
• CWE-526

Shescape potential environment variable exposure on Windows with CMD

• CWE-526

<1.7.1 · fixed in 1.7.1

Ecava IntegraXor SCADA Server Information Exposure Through Environmental Variables

• Ecava IntegraXor SCADA Server
• CWE-526