{"id":"CVE-2026-123316","kind":"vulnerability","aliases":["CVE-2026-123316"],"related":[],"title":"JetBrains Junie CLI: sensitive environment variables written to session logs","description":"In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs","summary":"Before version 26.6.29, Junie CLI, JetBrains' AI coding agent, wrote sensitive environment variables into its session event logs. Anyone who can read those logs can recover those secrets.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-coding-agent","ai-tooling","ci","jetbrains","junie-cli"],"not_affected_if":["no-sensitive-env-vars","version-26.6.29-or-later"],"how_to_check":"- Check the installed Junie CLI version and compare it with `26.6.29`.\n- Look for session event log files written by Junie CLI and check whether they contain environment variable values such as tokens or keys.","fix":"- Junie CLI: move to `26.6.29` or later.","status":"open","published_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","triaged_at":"2026-11-06T11:42:26+00:00","updated_at":"2026-11-06T11:42:26+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-06T11:42:26Z","model":"claude-haiku-5-5","output":{"fix":"- Junie CLI: move to `26.6.29` or later.","reach":"local","title":"JetBrains Junie CLI: sensitive environment variables written to session logs","impact":"medium","summary":"Before version 26.6.29, Junie CLI, JetBrains' AI coding agent, wrote sensitive environment variables into its session event logs. Anyone who can read those logs can recover those secrets.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["junie-cli","jetbrains","ai-coding-agent","ci"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Secrets from environment variables readable in session logs","analyst_note":"","how_to_check":"- Check the installed Junie CLI version and compare it with `26.6.29`.\n- Look for session event log files written by Junie CLI and check whether they contain environment variable values such as tokens or keys.","plain_action":"","needs_analyst":false,"not_affected_if":["version-26.6.29-or-later","no-sensitive-env-vars"],"who_is_affected":"Teams that run Junie CLI on developer machines or CI runners with secrets in the environment. Exposure depends on who can read the session logs afterward, such as shared logs or log collection. unknown whether the sources describe any other conditions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":4162,"output_tokens":502,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123316':13A,16A '-2026':12A,15A '26.6.29':31B,62C 'agent':20B,37B 'ai':18B,22B,35B 'ai-coding-ag':17B 'ai-tool':21B 'anyon':47B 'ci':24B 'cli':3A,28B,33B,60C 'code':19B,36B 'cve':11A,14A 'environ':5A,40B,64C 'event':45B,70C 'expos':67C 'jetbrain':1A,25B,34B,58C 'juni':2A,27B,32B,59C 'junie-c':26B 'log':10A,46B,52B,71C 'read':50B 'recov':54B 'secret':56B 'sensit':4A,39B,63C 'session':9A,44B,69C 'tool':23B 'variabl':6A,41B,65C 'version':30B 'written':7A 'wrote':38B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Junie CLI on developer machines or CI runners with secrets in the environment. Exposure depends on who can read the session logs afterward, such as shared logs or log collection. unknown whether the sources describe any other conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aicodingagent","aitooling","ci","jetbrains","juniecli","medium"],"campaign_type":null,"search_a":"'-123316':13A,16A '-2026':12A,15A 'cli':3A 'cve':11A,14A 'environ':5A 'jetbrain':1A 'juni':2A 'log':10A 'sensit':4A 'session':9A 'variabl':6A 'written':7A","search_b":"'26.6.29':31B 'agent':20B,37B 'ai':18B,22B,35B 'ai-coding-ag':17B 'ai-tool':21B 'anyon':47B 'ci':24B 'cli':28B,33B 'code':19B,36B 'environ':40B 'event':45B 'jetbrain':25B,34B 'juni':27B,32B 'junie-c':26B 'log':46B,52B 'read':50B 'recov':54B 'secret':56B 'sensit':39B 'session':44B 'tool':23B 'variabl':41B 'version':30B 'wrote':38B","search_c":"'26.6.29':62C 'cli':60C 'environ':64C 'event':70C 'expos':67C 'jetbrain':58C 'juni':59C 'log':71C 'sensit':63C 'session':69C 'variabl':65C","first_public_at":"2026-11-06T11:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123316","severity":null,"published_at":"2026-11-06T11:17:11+00:00","modified_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","fetched_at":"2026-11-06T11:41:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}