CVE-2026-127082 · Package
NO FIX YET · SEE WHAT TO DO
Huginn's JqAgent runs the jq tool as a child process that inherits the server's environment variables. A logged-in user who can create or dry-run a JqAgent can use an env or $ENV filter to read secrets such as APP_SECRET_TOKEN, database, SMTP and OAuth credentials.
first public Nov 10, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any Huginn deployment before 2026.11.09 where users with accounts can create, configure or dry-run a JqAgent is exposed, because the jq process sees the full server environment. Instances without JqAgent use, or where only trusted administrators have accounts, carry less risk. Sources do not state other preconditions.
Not affected if jqagent-unused, single-trusted-user
Who cares huginn, self-hosted
git describe --tags or the image tag; versions before 2026.11.09 are affected.2026.11.09 or later.Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.