CVE-2026-128026: FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenv
FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment through procopen or exec can read secrets such as database passwords set by other requests.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using FrankenPHP versions from 1.5.0 up to, but not including, 1.13.0 are affected when concurrent requests can set environment values with putenv and another reachable request path can start child processes.
What does an attacker need to exploit it?
The attacker needs access to a request path that causes a child process to be launched with the default environment, such as through proc_open or exec. That child process may then receive environment variables, including secrets, set by another concurrent request.
Are secrets exposed only from the attacker’s own request?
No. The issue is cross-request leakage: putenv writes to the process-wide operating-system environment, so values set by other concurrent requests can be inherited by spawned child processes.
What can be done if upgrading is not immediately possible?
Reduce or disable request paths that invoke proc_open or exec with the default environment, and avoid setting sensitive values through putenv during requests. This limits opportunities for child processes to inherit process-wide environment values.