{"id":"CVE-2026-128026","kind":"vulnerability","aliases":["CVE-2026-128026"],"related":[],"title":"FrankenPHP: putenv leaks environment values between concurrent requests","description":"FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment through proc_open or exec can read secrets such as database passwords set by other requests.","summary":"FrankenPHP's putenv writes to the process-wide OS environment, so values set by one request can be seen by others running at the same time. An attacker who reaches a request path that spawns child processes through proc_open or exec can read secrets such as database passwords set by other requests.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frankenphp","php","runtime","self-hosted"],"not_affected_if":["fixed-version","no-child-processes"],"how_to_check":"- Check the FrankenPHP version with `frankenphp version` or the binary used in the image; affected versions are from `1.5.0` before `1.13.0`.\n- Search application code for calls to `putenv`, `proc_open` and `exec` on request paths.","fix":"- FrankenPHP: move to `1.13.0` or later (the sources state this as the fixed version).","status":"open","published_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","triaged_at":"2026-11-13T10:54:35+00:00","updated_at":"2026-11-13T10:54:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-13T10:54:35Z","model":"claude-haiku-5-5","output":{"fix":"- FrankenPHP: move to `1.13.0` or later (the sources state this as the fixed version).","reach":"internet","title":"FrankenPHP: putenv leaks environment values between concurrent requests","impact":"medium","summary":"FrankenPHP's putenv writes to the process-wide OS environment, so values set by one request can be seen by others running at the same time. An attacker who reaches a request path that spawns child processes through proc_open or exec can read secrets such as database passwords set by other requests.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frankenphp","php","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"other requests' secrets, such as database passwords, readable by attackers","analyst_note":"Check the vendor advisory and the VulnCheck advisory for the exact trigger conditions.}","how_to_check":"- Check the FrankenPHP version with `frankenphp version` or the binary used in the image; affected versions are from `1.5.0` before `1.13.0`.\n- Search application code for calls to `putenv`, `proc_open` and `exec` on request paths.\n- unknown whether the sources name a configuration that limits exposure.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-child-processes","fixed-version"],"who_is_affected":"Servers running FrankenPHP from 1.5.0 before 1.13.0 are exposed, most where request code sets environment variables with putenv and then runs child processes via proc_open or exec. Applications that do not spawn child processes from request handling are less exposed. unknown whether the sources give further detail on the exact configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000773,"input_tokens":4629,"output_tokens":620,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128026':11A,14A '-2026':10A,13A '1.13.0':79C '1.5.0':77C 'across':101C 'attack':49B,104C 'child':57B,111C 'concurr':7A,102C 'contain':80C 'cve':9A,12A 'databas':69B,127C 'default':115C 'environ':4A,31B,83C,96C,116C 'exec':63B,121C 'frankenphp':1A,15B,21B,75C 'host':20B 'incomplet':82C 'leak':3A,99C 'one':36B 'open':61B,119C 'os':30B,95C 'os.setenv':98C 'other':42B 'password':70B,128C 'path':54B,108C 'php':16B 'proc':60B,118C 'process':28B,58B,93C,112C 'process-wid':27B,92C 'putenv':2A,23B,88C 'reach':51B,105C 'read':65B,123C 'request':8A,37B,53B,74B,103C,107C,132C 'run':43B 'runtim':17B 'sandbox':84C 'secret':66B,124C 'seen':40B 'self':19B 'self-host':18B 'set':34B,71B,129C 'spawn':56B,110C 'time':47B 'valu':5A,33B,100C 'via':97C 'vulner':85C 'wide':29B,94C 'write':24B,89C","nicknames":[],"mitigations":[],"who_affected":"Servers running FrankenPHP from 1.5.0 before 1.13.0 are exposed, most where request code sets environment variables with putenv and then runs child processes via proc_open or exec. Applications that do not spawn child processes from request handling are less exposed. unknown whether the sources give further detail on the exact configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frankenphp","medium","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-128026':11A,14A '-2026':10A,13A 'concurr':7A 'cve':9A,12A 'environ':4A 'frankenphp':1A 'leak':3A 'putenv':2A 'request':8A 'valu':5A","search_b":"'attack':49B 'child':57B 'databas':69B 'environ':31B 'exec':63B 'frankenphp':15B,21B 'host':20B 'one':36B 'open':61B 'os':30B 'other':42B 'password':70B 'path':54B 'php':16B 'proc':60B 'process':28B,58B 'process-wid':27B 'putenv':23B 'reach':51B 'read':65B 'request':37B,53B,74B 'run':43B 'runtim':17B 'secret':66B 'seen':40B 'self':19B 'self-host':18B 'set':34B,71B 'spawn':56B 'time':47B 'valu':33B 'wide':29B 'write':24B","search_c":"'1.13.0':79C '1.5.0':77C 'across':101C 'attack':104C 'child':111C 'concurr':102C 'contain':80C 'databas':127C 'default':115C 'environ':83C,96C,116C 'exec':121C 'frankenphp':75C 'incomplet':82C 'leak':99C 'open':119C 'os':95C 'os.setenv':98C 'password':128C 'path':108C 'proc':118C 'process':93C,112C 'process-wid':92C 'putenv':88C 'reach':105C 'read':123C 'request':103C,107C,132C 'sandbox':84C 'secret':124C 'set':129C 'spawn':110C 'valu':100C 'via':97C 'vulner':85C 'wide':94C 'write':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-04T14:04:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128026","severity":null,"published_at":"2026-11-13T10:18:08+00:00","modified_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","fetched_at":"2026-11-13T10:47:31+00:00","note":null}],"documents":[{"id":145352,"url":"https://github.com/php/frankenphp/security/advisories/GHSA-996f-w38m-f574","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-04T14:04:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145353,"url":"https://www.vulncheck.com/advisories/frankenphp-1.5.0-before-1.13.0-cross-request-environment-leakage-via-putenv","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}