CWE · MITRE source
CWE-526Cleartext Storage of Sensitive Information in an Environment Variable
The product uses an environment variable to store unencrypted sensitive information.
Information stored in an environment variable can be accessible by other processes with the execution context, including child processes that dependencies are executed in, or serverless functions in cloud environments. An environment variable's contents can also be inserted into messages, headers, log files, or other outputs. Often these other dependencies have no need to use the environment variable in question. A weakness that discloses environment variables could expose this information.
Last updated: 15 October 2026 14:21 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A02:2025 Security Misconfiguration.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2025-28381 UPD | 5.9 | 7.5 | 0.0052 | 2025-06-13 |
CVE-2023-5720 UPD | 5.8 | 7.7 | 0.0081 | 2023-11-15 |
CVE-2026-45370 UPD | 5.6 | 7.7 | 0.0037 | 2026-05-14 |
CVE-2026-40153 UPD | 5.4 | 7.4 | 0.0039 | 2026-04-09 |
CVE-2024-2700 UPD | 5.2 | 7.0 | 0.0029 | 2024-04-04 |
CVE-2024-4369 UPD | 5.2 | 6.8 | 0.0069 | 2024-05-01 |
CVE-2023-43029 UPD | 5.1 | 6.8 | 0.0044 | 2025-03-21 |
CVE-2026-72648 UPD | 5.1 | 6.5 | 0.0043 | 2026-08-13 |
CVE-2024-12604 UPD | 5.0 | 6.5 | 0.0021 | 2025-03-10 |
CVE-2025-36017 UPD | 5.0 | 6.5 | 0.0027 | 2025-12-08 |
CVE-2025-0985 UPD | 4.3 | 5.5 | 0.0026 | 2025-02-28 |
CVE-2025-27899 UPD | 4.3 | 5.3 | 0.0023 | 2026-02-17 |
CVE-2026-76227 UPD | 4.2 | 5.5 | 0.0015 | 2026-08-19 |
CVE-2026-108592 | 4.2 | 5.3 | 0.0032 | 2026-10-10 |
CVE-2024-11736 UPD | 4.1 | 4.9 | 0.0077 | 2025-01-14 |
CVE-2014-2377 UPD | 4.0 | 0.0 | 0.0184 | 2014-09-15 |
CVE-2025-9162 UPD | 4.0 | 4.9 | 0.0050 | 2025-08-21 |
CVE-2026-49377 UPD | 3.9 | 4.3 | 0.0092 | 2026-05-29 |
CVE-2025-36105 UPD | 3.3 | 4.4 | 0.0008 | 2026-03-10 |
CVE-2023-35931 UPD | 3.0 | 3.1 | 0.0081 | 2023-06-23 |
CVE-2023-47615 UPD | 2.8 | 3.3 | 0.0021 | 2023-11-09 |