---
id: "CVE-2026-123316"
page: "https://infrastack.ai/live/CVE-2026-123316"
kind: "vulnerability"
aliases: ["CVE-2026-123316"]
title: "JetBrains Junie CLI: sensitive environment variables written to session logs"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-coding-agent", "ai-tooling", "ci", "jetbrains", "junie-cli"]
not_affected_if: ["no-sensitive-env-vars", "version-26.6.29-or-later"]
published_at: "2026-11-06T11:17:11+00:00"
first_seen_at: "2026-11-06T11:41:26+00:00"
updated_at: "2026-11-06T11:42:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123316", "first_seen_at": "2026-11-06T11:41:26+00:00"}]
exploit_sources: []
---

# JetBrains Junie CLI: sensitive environment variables written to session logs

Link for people: https://infrastack.ai/live/CVE-2026-123316 (this .md is for agents)

Before version 26.6.29, Junie CLI, JetBrains' AI coding agent, wrote sensitive environment variables into its session event logs. Anyone who can read those logs can recover those secrets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Junie CLI version and compare it with `26.6.29`.
- Look for session event log files written by Junie CLI and check whether they contain environment variable values such as tokens or keys.

## Fix

- Junie CLI: move to `26.6.29` or later.

## Timeline

- 2026-11-06T11:41:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123316

## From the sources

In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_