CVE-2026-29872

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-29872", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-30T18:15:13.246Z", "dateReserved": "2026-03-04T00:00:00.000Z", "datePublished": "2026-03-30T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-30T17:07:07.350Z"}, "descriptions": [{"lang": "en", "value": "A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in process-wide environment variables using os.environ without proper session isolation. Because Streamlit serves multiple concurrent users from a single Python process, credentials provided by one user remain accessible to subsequent unauthenticated users. An attacker can exploit this issue to retrieve sensitive information such as GitHub Personal Access Tokens or LLM API keys, potentially leading to unauthorized access to private resources and financial abuse."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/lilmingwa13/security-research/blob/main/CVE-2026-29872.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-522", "lang": "en", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T18:14:28.265986Z", "id": "CVE-2026-29872", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T18:15:13.246Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-29872", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T18:14:28.265986Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T18:12:21.520Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/lilmingwa13/security-research/blob/main/CVE-2026-29872.md"}], "descriptions": [{"lang": "en", "value": "A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in process-wide environment variables using os.environ without proper session isolation. Because Streamlit serves multiple concurrent users from a single Python process, credentials provided by one user remain accessible to subsequent unauthenticated users. An attacker can exploit this issue to retrieve sensitive information such as GitHub Personal Access Tokens or LLM API keys, potentially leading to unauthorized access to private resources and financial abuse."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-30T17:07:07.350Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29872", "state": "PUBLISHED", "dateUpdated": "2026-03-30T18:15:13.246Z", "dateReserved": "2026-03-04T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-30T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:theunwindai:awesome_llm_apps:2026-01-19:*:*:*:*:*:*:*", "matchCriteriaId": "4B8162DF-5C1B-41A9-8133-D5A28E01E46C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in process-wide environment variables using os.environ without proper session isolation. Because Streamlit serves multiple concurrent users from a single Python process, credentials provided by one user remain accessible to subsequent unauthenticated users. An attacker can exploit this issue to retrieve sensitive information such as GitHub Personal Access Tokens or LLM API keys, potentially leading to unauthorized access to private resources and financial abuse."}, {"lang": "es", "value": "Existe una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n entre sesiones en el proyecto awesome-llm-apps en el commit e46690f99c3f08be80a9877fab52acacf7ab8251 (19-01-2026). El agente GitHub MCP basado en Streamlit afectado almacena tokens de API proporcionados por el usuario en variables de entorno a nivel de proceso usando os.environ sin un aislamiento de sesi\u00f3n adecuado. Debido a que Streamlit sirve a m\u00faltiples usuarios concurrentes desde un \u00fanico proceso de Python, las credenciales proporcionadas por un usuario permanecen accesibles para usuarios no autenticados posteriores. Un atacante puede explotar este problema para recuperar informaci\u00f3n sensible como Tokens de Acceso Personal de GitHub o claves de API de LLM, lo que podr\u00eda llevar a un acceso no autorizado a recursos privados y abuso financiero."}], "id": "CVE-2026-29872", "lastModified": "2026-06-17T10:29:55.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29872", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-30T18:14:28.265986Z", "version": "2.0.3"}}]}, "published": "2026-03-30T18:16:18.523", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://github.com/lilmingwa13/security-research/blob/main/CVE-2026-29872.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-522"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e46690f99c3f08be80a9877fab52acacf7ab8251"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "awesome-llm-apps", "vendor": "shubhamsaboo"}], "analysis": {"en": {"generated_at": "2026-04-06T19:57:43.433683+00:00", "value": {"mitigation_remediation": ["Inspect the application code to confirm that API tokens are stored in os.environ.", "Refactor the code so that tokens are stored in per\u2011session storage such as Streamlit session_state instead of a process\u2011wide environment variable.", "Restrict exposure of environment variables through the web interface so that only authorized users can query them.", "Implement authentication or network segmentation so that only trusted users can access the application.", "Regularly audit token handling and rotate credentials to minimize potential leakage."], "summary": {"action": "Update", "impact": "API token disclosure"}, "threat_synthesis": {"affected_systems": "This issue affects the Awesome\u2011LLM\u2011Apps project, specifically the release built from commit e46690f99c3f08be80a9877fab52acacf7ab8251 released on 2026\u201101\u201119. The product is a Streamlit\u2011based GitHub MCP Agent designed for use by multiple concurrent users.", "description_and_impact": "The Awesome\u2011LLM\u2011Apps application stores user\u2011supplied API tokens in process\u2011wide environment variables using os.environ, lacking session isolation. Because the Streamlit framework serves multiple concurrent users from a single Python process, credentials supplied by one user remain accessible to subsequent, unauthenticated users, creating a vulnerability that can leak sensitive information such as GitHub Personal Access Tokens or LLM API keys. This breach of confidentiality is classified under CWE\u2011200, CWE\u2011284, and CWE\u2011522, potentially allowing attackers to access private resources or incur unauthorized charges.", "risk_and_exploitability": "The vulnerability has a high CVSS score of 8.2, but its EPSS score is below 1\u202f%, indicating a low to moderate probability of exploitation at present. It is not listed in CISA's KEV catalog. Likely attack vectors involve remote interaction with the Streamlit web interface, where an attacker can submit a session that sets an environment variable or retrieve a token stored from a previous session. Successful exploitation would grant unauthorized access to the victim\u2019s private repositories or LLM services."}}}}, "created": "2026-03-30T20:56:17.775367+00:00", "updated": "2026-04-07T08:08:42.277045+00:00", "vendors": ["shubhamsaboo", "shubhamsaboo$PRODUCT$awesome-llm-apps"]}