CVE-2026-127082
Received Received - Intake

Information Exposure in Huginn via JqAgent Environment Leak

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127082
EUVD
EUVD-2026-125100

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
huginn huginn From 0 (inc) to 2026.11.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Huginn before version 2026.11.09 has an information exposure flaw in the JqAgent component. Authenticated users can exploit this to read the server's process environment by creating a JqAgent filter using 'env' or '$ENV'. This allows attackers to access sensitive secrets like APP_SECRET_TOKEN, database credentials, SMTP settings, and OAuth tokens.

Detection Guidance

Check Huginn logs for suspicious JqAgent filter usage containing env or $ENV keywords. Inspect environment variables exposed in child processes by monitoring jq command execution with tools like strace or ps.

Impact Analysis

If exploited, attackers could gain access to critical secrets such as database passwords, email server credentials, or authentication tokens. This could lead to unauthorized access to systems, data breaches, or further compromise of the Huginn instance or connected services.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face regulatory fines, legal liabilities, and reputational damage due to non-compliance resulting from this exposure.

Mitigation Strategies

Upgrade Huginn to version 2026.11.09 or later to patch the vulnerability. Review and restrict user permissions to prevent unauthorized JqAgent configuration access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127082. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...