CVE-2026-128019
Deferred Deferred - Pending Action

FrankenPHP Worker Mode Information Disclosure Vulnerability

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128019
EUVD
EUVD-2026-125083

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frankenphp frankenphp to 1.13.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FrankenPHP before 1.13.4 has an information disclosure vulnerability in worker mode where environment variables from one request leak into subsequent requests on the same PHP thread. Attackers can access sensitive values set via environment directives or request-specific functions through getenv() or $_SERVER, potentially causing applications to use another user's routing, tenant, or authorization values.

Detection Guidance

To detect this vulnerability, check if your FrankenPHP version is below 1.13.4. Run: frankenphp version. If affected, inspect PHP worker mode logs for environment variable leaks or unexpected tenant/authorization values across requests.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data, incorrect application behavior due to mixed user contexts, and potential data exposure. Applications may inadvertently use another user's routing, tenant, or authorization values, causing security breaches or compliance violations.

Compliance Impact

This vulnerability can lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It risks non-compliance due to potential data leaks and incorrect access controls.

Mitigation Strategies

Upgrade FrankenPHP to version 1.13.4 or later immediately. Avoid using worker mode if possible or ensure no sensitive environment variables are set via request placeholders or WithRequestEnv(). Review application logs for unauthorized access patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128019. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...