CWE-526 · Information Disclosure
Cleartext Storage of Sensitive Information in an Environment Variable
23CVEs
SortMost likely exploited
23 CVEs with CWE-526 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2014-2377Ecava IntegraXor SCADA Server Information Exposure Through Environmental VariablesEcava · IntegraXor SCADA Server · CVSS 5 · 2014-09-15 | 5.0 | 1.8% | 2014-09-15 |
| CVE-2023-5720Quarkus: build env information disclosure via gradle pluginQuarkus · gradle-plugin · CVSS 7.7 · 2023-11-15 | 7.7 | 1.0% | 2023-11-15 |
| CVE-2023-35931Shescape potential environment variable exposure on Windows with CMDericcornelissen · shescape · CVSS 3.1 · 2023-06-23 | 3.1 | 0.8% | 2023-06-23 |
| CVE-2024-11736Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variablesRed Hat · Red Hat build of Keycloak 26.0 · CVSS 4.9 · 2025-01-14 | 4.9 | 0.8% | 2025-01-14 |
| CVE-2026-49377In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parametersJetBrains · TeamCity · CVSS 4.3 · 2026-05-29 | 4.3 | 0.7% | 2026-05-29 |
| CVE-2024-4369Cluster-image-registry-operator: exposes a secret via env variable in pod definition on azureRed Hat · Red Hat OpenShift Container Platform 4.14 · CVSS 6.8 · 2024-04-30 | 6.8 | 0.7% | 2024-04-30 |
| CVE-2025-9162Org.keycloak/keycloak-model-storage-service: variable injection into environment variablesKeycloak · keycloak · CVSS 4.9 · 2025-08-21 | 4.9 | 0.6% | 2025-08-21 |
| CVE-2025-28381A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.Openc3 · Cosmos · CVSS 7.5 · 2025-06-13 | 7.5 | 0.5% | 2025-06-13 |
| CVE-2023-43029IBM Storage Virtualize vSphere Remote Plug-in information disclosureIBM · Storage Virtualize vSphere Remote Plug-in · CVSS 6.8 · 2025-03-21 | 6.8 | 0.4% | 2025-03-21 |
| CVE-2026-72648Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information DisclosureElastic · Eck Operator · CVSS 6.5 · 2026-08-13 | 6.5 | 0.4% | 2026-08-13 |
| CVE-2026-77938Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritanceletta-ai · letta · CVSS 6.5 · 2026-10-20 | 6.5 | 0.4% | 2026-10-20 |
| CVE-2026-108592mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironmentSWE-agent · mini-swe-agent · CVSS 5.3 · 2026-10-10 | 5.3 | 0.3% | 2026-10-10 |
| CVE-2024-2700Quarkus-core: leak of local configuration properties into quarkus applicationsRedhat · quarkus-core · CVSS 7 · 2024-04-04 | 7.0 | 0.3% | 2024-04-04 |
| CVE-2025-36017IBM Controller Information DisclosureIBM · Controller · CVSS 6.5 · 2025-12-08 | 6.5 | 0.3% | 2025-12-08 |
| CVE-2026-40153PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell ToolMervinPraison · PraisonAIAgents · CVSS 7.4 · 2026-04-09 | 7.4 | 0.3% | 2026-04-09 |
| CVE-2025-0985IBM MQ information disclosureIBM · MQ · CVSS 5.5 · 2025-02-28 | 5.5 | 0.3% | 2025-02-28 |
| CVE-2025-27899Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsIBM · DB2 Recovery Expert for LUW · CVSS 5.3 · 2026-02-17 | 5.3 | 0.2% | 2026-02-17 |
| CVE-2023-47615A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Teli…Telit Cinterion · BGS5 · CVSS 3.3 · 2023-11-09 | 3.3 | 0.2% | 2023-11-09 |
| CVE-2026-45370python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injectionuniversal-tool-calling-protocol · python-utcp · CVSS 7.7 · 2026-05-14 | 7.7 | 0.2% | 2026-05-14 |
| CVE-2026-54146OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)tinyhumansai · openhuman · CVSS 8.8 · 2026-11-05 | 8.8 | 0.2% | 2026-11-05 |
| CVE-2024-12604Improper Authentication in Tapandsign Technologies Tap and Sign AppTapandsign Technologies · Tap&Sign App · CVSS 6.5 · 2025-03-10 | 6.5 | 0.2% | 2025-03-10 |
| CVE-2026-76227Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposurerenovatebot · renovate · CVSS 5.5 · 2026-08-19 | 5.5 | 0.2% | 2026-08-19 |
| CVE-2025-36105IBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerabilityIBM · Planning Analytics Advanced Certified Containers · CVSS 4.4 · 2026-03-10 | 4.4 | 0.1% | 2026-03-10 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.