EUVD-2026-51240

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

CVE-2026-12940

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Summary The capability policy denies the env.get and env.loaddotenv modules by default, with the stated reason that they read arbitrary host environment variables API keys, DSNs and are a secret-exfil risk. But the workflow engine's variable resolver expands $env.VAR for any environment variable...

EUVD-2026-50471

Flyto2 Core: $env.VAR interpolation reads any env secret despite env.get being denylisted...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-59326 HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

CVE-2026-59326: Insertion of Sensitive Information into Log File

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

EUVD-2026-51327

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

CVE-2026-12940: Improper Neutralization of Special Elements used in an OS Command

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

CVE-2026-52539

Outstatic CMS versions

PT-2026-66413

The Spring Boot language server logs the raw value of the https proxy/HTTPS PROXY/http proxy/HTTP PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth...

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

CVE-2026-67427 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...

CVE-2026-67427 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...

CVE-2026-67427 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...

PT-2026-65894

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check. This allows a workflow parameter to bypass the default...

gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL

A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clonefrom method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to...

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

Summary The fix for GHSA-rwj8-pgh3-r573 stopped Repo.clonefrom from running caller-supplied URLs through os.path.expandvars, but it guarded only that one caller. Remote.create — reached from the public Repo.createremote and its Remote.add alias — still passes an attacker-influenceable URL through...