JET ADMIN CLOUD PLATFORM · CVE-2026-123965 · Vendor
NO FIX YET · SEE WHAT TO DO
Jet Admin Cloud Platform has a prompt injection flaw in all versions. A remote attacker with a free account can make the platform expose .env configuration files and leak the credentials stored in them.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that use Jet Admin Cloud Platform (the hosted service, per CISA's advisory) and keep credentials in .env files or other config the platform's AI features can read. CISA lists all versions as affected and says a remote attacker with only a free account can make the platform expose .env files and leak the credentials in them. Teams that do not use Jet Admin can skip it. Whether self-hosted or on-premise Jet Admin installs are affected is not stated.
Not affected if no-jet-admin-account
Who cares cloud-platform, hosted, jet-admin, prompt-injection, secrets-exposure
none availableA prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.