CVE-2026-76805
Received Received - Intake

Nuclei Fuzz Engine Double Evaluation Flaw

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor in one protocol step to be reinterpreted as template syntax in a later fuzz step. This vulnerability is an incomplete fix for CVE-2026-41645: the prior remediation made expressions.Evaluate() single-pass within one call but did not prevent DAST/fuzz callers from evaluating substituted output again. When -env-vars is enabled, a malicious scan target can return marker-shaped content that resolves against the template variable map and discloses scanner-host environment variables such as credentials, API keys, or tokens. The vulnerability requires a multi-step DAST or fuzz template, response data reused through an internal extractor, and explicit environment-variable expansion; users who do not enable -env-vars are not affected by the sensitive-information disclosure. This issue is fixed in version 3.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-76805
EUVD
EUVD-2026-84557

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
projectdiscovery nuclei From 3.0.0 (inc) to 3.10.0 (exc)
projectdiscovery nuclei 3.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76805 is a vulnerability in Nuclei's DAST/fuzz mode where response data from a scan target can be incorrectly re-evaluated as template syntax. This happens when runtime data, such as responses or payloads, is processed through an internal extractor and then reinterpreted as part of the template logic. The issue stems from incomplete fixes for prior vulnerabilities, allowing environment variables like credentials or API keys to be disclosed if the -env-vars flag is enabled.

Detection Guidance

To detect this vulnerability, check if you are running Nuclei versions between 3.0.0 and 3.9.0 with the -env-vars (-ev) flag enabled. Verify if multi-step DAST or fuzz templates are used against untrusted targets. Commands to check version: nuclei -version. If vulnerable, upgrade to 3.10.0 or later.

Impact Analysis

If you use Nuclei versions between 3.0.0 and 3.10.0 with the -env-vars flag enabled, a malicious scan target could return specially crafted content that exposes your scanner's environment variables, including credentials, API keys, or tokens. This requires a multi-step DAST or fuzz template and response data reused through an internal extractor. Users without -env-vars enabled are not affected.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, such as credentials or API keys, which may violate compliance requirements under GDPR (data protection) or HIPAA (healthcare data privacy). Unauthorized exposure of such data could result in regulatory penalties or breaches of confidentiality obligations.

Mitigation Strategies

Immediately upgrade Nuclei to version 3.10.0 or later. If upgrading is not possible, disable the -env-vars (-ev) flag when scanning untrusted targets. Avoid using multi-step DAST or fuzz templates against untrusted servers until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76805. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart