The product uses an environment variable to store unencrypted sensitive information.

What CVEs are caused by CWE-526?

16 recorded CVEs are attributed to CWE-526, including CVE-2026-45370, CVE-2023-5720, CVE-2025-28381.

What are the consequences of CWE-526?

Exploiting CWE-526 can lead to: Read Application Data.

Is CWE-526 actively exploited?

16 recorded CVEs are caused by CWE-526; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable

Overview

Information stored in an environment variable can be accessible by other processes with the execution context, including child processes that dependencies are executed in, or serverless functions in cloud environments. An environment variable's contents can also be inserted into messages, headers, log files, or other outputs. Often these other dependencies have no need to use the environment variable in question. A weakness that discloses environment variables could expose this information.

Real-world CVEs

16 recorded CVEs are caused by CWE-526 (Cleartext Storage of Sensitive Information in an Environment Variable). The highest-severity and most recent are shown first. 4 new CWE-526 CVEs have been recorded so far in 2026 (6 in 2025).

Showing 12 of 16 recorded CWE-526 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-526 vulnerabilities

Common consequences

What can happen when CWE-526 is exploited.

Read Application Data

Affects: Confidentiality

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

Operation

How to prevent it

Practical mitigations for CWE-526, grouped by where in the lifecycle they apply.

Architecture and Design

Encrypt information stored in the environment variable to protect it from being exposed to an unauthorized user. If encryption is not feasible or is considered too expensive for the business use of the application, then consider using a properly protected configuration file instead of an environment variable. It should be understood that unencrypted information in a config file is also not guaranteed to be protected, but it is still a better choice, because it reduces attack surface related to weaknesses such as CWE-214. In some settings, vaults might be a feasible option for safer data transfer. Users should be notified of the business choice made to not protect the sensitive information through encryption.

Implementation

If the environment variable is not necessary for the desired behavior, then remove it entirely, or clear it to an empty value.

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2022-43691 — CMS shows sensitive server-side information from environment variables when run in Debug mode.
CVE-2022-27195 — Plugin for an automation server inserts environment variable contents into build XML files.
CVE-2022-25264 — CI/CD tool logs environment variables related to passwords add Contribution to content history.

How this weakness relates to others in the CWE hierarchy.

Parent

CWE-312: Cleartext Storage of Sensitive Information

Peer

CWE-214: Invocation of Process Using Visible Sensitive Information

Terminology & mappings

Mapped taxonomies

Software Fault Patterns: Exposed Data (SFP23)

Frequently asked questions

Common questions about CWE-526.

What is CWE-526?: The product uses an environment variable to store unencrypted sensitive information.
What CVEs are caused by CWE-526?: 16 recorded CVEs are attributed to CWE-526, including CVE-2026-45370, CVE-2023-5720, CVE-2025-28381.
How do you prevent CWE-526?: Encrypt information stored in the environment variable to protect it from being exposed to an unauthorized user. If encryption is not feasible or is considered too expensive for the business use of the application, then consider using a properly protected configuration file instead of an environment variable. It should be understood that unencrypted information in a config file is also not guaranteed to be protected, but it is still a better choice, because it reduces attack surface related to weaknesses such as CWE-214. In some settings, vaults might be a feasible option for safer data transfer. Users should be notified of the business choice made to not protect the sensitive information through encryption.
How is CWE-526 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-526?: Exploiting CWE-526 can lead to: Read Application Data.
Is CWE-526 actively exploited?: 16 recorded CVEs are caused by CWE-526; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.