Cleartext Storage of Sensitive Information in an Environment Variable
CWE-526
The product uses an environment variable to store unencrypted sensitive information.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7.
How this weakness is prevented
- Implementation: If the environment variable is not necessary for the desired behavior, then remove it entirely, or clear it to an empty value.
Latest Cleartext Storage of Sensitive Information in an Environment Variable vulnerabilities
- 8.8 High severity
openhuman: Cleartext Storage of Sensitive Information in an Environment Variable
OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, core_process.rs in the Tauri desktop process publishes the per-launch OPENHUMAN_CORE_TOKEN bearer credential in its process envi
- 7.6 High severity
pgAdmin 4: Invocation of Process Using Visible Sensitive Information
To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing remove
- 7.7 High severity
python-utcp: Cleartext Storage of Sensitive Information in an Environment Variable
python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level
- 7.0 High severity
HawtIO 4.0.0 for Red Hat build of Apache Camel 4: Cleartext Storage of Sensitive Information in an Environment Variable
A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local
- 7.5 High severity
gradle-plugin: Cleartext Storage of Sensitive Information in an Environment Variable
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system with