CVE-2026-127082

EUVD-2026-125100
Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 39.82%
Common Weakness Enumeration
References
https://github.com/huginn/huginn/blob/v2026.11.05.2/app/models/agents/jq_agent.rb#L166
https://github.com/huginn/huginn/commit/826f4bd471c027660b1951408b44f9e5c5452aff
https://github.com/huginn/huginn/releases/tag/v2026.11.09
https://github.com/huginn/huginn/security/advisories/GHSA-3f56-748g-q34j
https://www.vulncheck.com/advisories/huginn-before-2026.11.09-information-exposure-via-jqagent-jq-env-builtin