CVE-2026-127082

HighCVSS 7.7/10Last modified Nov 13, 2026

Description

Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1270836.4Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the e CVE-2026-1270847.3Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG o CVE-2026-1270854.3Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collec CVE-2026-1270866.3Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by s CVE-2026-1270873.1Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by sup CVE-2026-1270888.12FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging t CVE-2026-1270908.8Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication b CVE-2026-1270916.8Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path eq CVE-2026-1270926.1BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascrip CVE-2026-1270935.5Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send req CVE-2026-1270947.6Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.CVE-2026-1270995.9A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components in