{"id":"CVE-2026-127082","kind":"vulnerability","aliases":["CVE-2026-127082"],"related":[],"title":"Huginn: JqAgent lets logged-in users read server secrets","description":"Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets.","summary":"Huginn's JqAgent runs the jq tool as a child process that inherits the server's environment variables. A logged-in user who can create or dry-run a JqAgent can use an env or $ENV filter to read secrets such as APP_SECRET_TOKEN, database, SMTP and OAuth credentials.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["huginn","package","self-hosted"],"not_affected_if":["jqagent-unused","single-trusted-user"],"how_to_check":"- Check the Huginn version with `git describe --tags` or the image tag; versions before `2026.11.09` are affected.\n- Check whether JqAgent is in use by reviewing agents of type JqAgent in the Huginn UI or database.\n- Confirm which users have accounts that can create or edit agents.","fix":"- Huginn: upgrade to `2026.11.09` or later.","status":"open","published_at":"2026-11-13T10:18:04+00:00","first_seen_at":"2026-11-13T10:47:29+00:00","triaged_at":"2026-11-13T10:51:07+00:00","updated_at":"2026-11-13T10:51:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:51:07Z","model":"claude-haiku-5-5","output":{"fix":"- Huginn: upgrade to `2026.11.09` or later.","reach":"internet","title":"Huginn: JqAgent lets logged-in users read server secrets","impact":"high","summary":"Huginn's JqAgent runs the jq tool as a child process that inherits the server's environment variables. A logged-in user who can create or dry-run a JqAgent can use an env or $ENV filter to read secrets such as APP_SECRET_TOKEN, database, SMTP and OAuth credentials.","audience":"businesses","category":"package","nicknames":[],"who_cares":["huginn","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users read server secrets, including application and database credentials.","analyst_note":"","how_to_check":"- Check the Huginn version with `git describe --tags` or the image tag; versions before `2026.11.09` are affected.\n- Check whether JqAgent is in use by reviewing agents of type JqAgent in the Huginn UI or database.\n- Confirm which users have accounts that can create or edit agents.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["jqagent-unused","single-trusted-user"],"who_is_affected":"Any Huginn deployment before 2026.11.09 where users with accounts can create, configure or dry-run a JqAgent is exposed, because the jq process sees the full server environment. Instances without JqAgent use, or where only trusted administrators have accounts, carry less risk. Sources do not state other preconditions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4645,"output_tokens":573,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127082':13A,16A '-2026':12A,15A '2026.11.09':76C 'allow':85C 'app':66B,122C 'attack':101C 'authent':86C 'child':31B,97C 'configur':105C 'contain':77C 'creat':47B,104C 'credenti':73B 'cve':11A,14A 'databas':69B,125C 'disclos':121C 'dri':50B,108C 'dry-run':49B,107C 'env':57B,59B,117C,119C 'environ':38B,93C 'exposur':80C 'filter':60B,115C 'host':21B 'huginn':1A,17B,22B,74C 'inform':79C 'inherit':34B,99C 'jq':27B,96C 'jqagent':2A,24B,53B,83C,111C 'let':3A 'log':5A,42B 'logged-in':4A,41B 'oauth':72B,128C 'packag':18B 'process':32B,92C,98C 'read':8A,62B,89C 'run':25B,51B,109C 'secret':10A,63B,67B,123C,129C 'self':20B 'self-host':19B 'server':9A,36B,91C 'smtp':70B,126C 'suppli':113C 'token':68B,124C 'tool':28B 'use':55B,116C 'user':7A,44B,87C 'variabl':39B 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Any Huginn deployment before 2026.11.09 where users with accounts can create, configure or dry-run a JqAgent is exposed, because the jq process sees the full server environment. Instances without JqAgent use, or where only trusted administrators have accounts, carry less risk. Sources do not state other preconditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","huginn","package","selfhosted"],"campaign_type":null,"search_a":"'-127082':13A,16A '-2026':12A,15A 'cve':11A,14A 'huginn':1A 'jqagent':2A 'let':3A 'log':5A 'logged-in':4A 'read':8A 'secret':10A 'server':9A 'user':7A","search_b":"'app':66B 'child':31B 'creat':47B 'credenti':73B 'databas':69B 'dri':50B 'dry-run':49B 'env':57B,59B 'environ':38B 'filter':60B 'host':21B 'huginn':17B,22B 'inherit':34B 'jq':27B 'jqagent':24B,53B 'log':42B 'logged-in':41B 'oauth':72B 'packag':18B 'process':32B 'read':62B 'run':25B,51B 'secret':63B,67B 'self':20B 'self-host':19B 'server':36B 'smtp':70B 'token':68B 'tool':28B 'use':55B 'user':44B 'variabl':39B","search_c":"'2026.11.09':76C 'allow':85C 'app':122C 'attack':101C 'authent':86C 'child':97C 'configur':105C 'contain':77C 'creat':104C 'databas':125C 'disclos':121C 'dri':108C 'dry-run':107C 'env':117C,119C 'environ':93C 'exposur':80C 'filter':115C 'huginn':74C 'inform':79C 'inherit':99C 'jq':96C 'jqagent':83C,111C 'oauth':128C 'process':92C,98C 'read':89C 'run':109C 'secret':123C,129C 'server':91C 'smtp':126C 'suppli':113C 'token':124C 'use':116C 'user':87C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:00:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127082","severity":null,"published_at":"2026-11-13T10:18:04+00:00","modified_at":"2026-11-13T10:18:04+00:00","first_seen_at":"2026-11-13T10:47:29+00:00","fetched_at":"2026-11-13T10:47:29+00:00","note":null}],"documents":[{"id":145286,"url":"https://github.com/huginn/huginn/commit/826f4bd471c027660b1951408b44f9e5c5452aff","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145287,"url":"https://github.com/huginn/huginn/releases/tag/v2026.11.09","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":145288,"url":"https://github.com/huginn/huginn/security/advisories/GHSA-3f56-748g-q34j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T20:00:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145289,"url":"https://www.vulncheck.com/advisories/huginn-before-2026.11.09-information-exposure-via-jqagent-jq-env-builtin","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}