CVE-2026-127082: Huginn before 2026.11.09 Information Exposure via JqAgent jq env Builtin
Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APPSECRETTOKEN, database, SMTP and OAuth secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.11.09
Event History
Frequently Asked Questions
Which users need to be considered capable of exploiting this issue?
Authenticated users who can create, configure, or dry-run a JqAgent can exploit it. No user interaction is required beyond those permissions.
What information could be exposed if exploitation succeeds?
A crafted jq filter using env or $ENV can read the server process environment. This may disclose APP_SECRET_TOKEN, database credentials, SMTP secrets, and OAuth secrets.
Which Huginn versions require remediation?
Huginn versions before 2026.11.09 are affected. Upgrade to 2026.11.09 or later.