{"id":"CVE-2026-128019","aliases":[],"cve":{"records":[{"id":"CVE-2026-128019","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-12T20:32:53.532Z","published":"2026-11-13T09:34:08.571Z","modified":"2026-11-13T09:34:08.571Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T09:34:08.571Z"}],"references":[{"url":"https://github.com/php/frankenphp/security/advisories/GHSA-8386-64gm-3m8q","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199","tags":["patch"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-information-disclosure-via-per-request-environment-variable-leak","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-200","description":"Exposure of Sensitive Information to an Unauthorized Actor","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*","versionEndExcluding":"1.13.4"}]}]}]}],"prioritization":[]},"title":"FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.","score":6.3,"severity":"medium","published":"2026-11-13T09:34:08.571Z","modified":"2026-11-13T09:34:08.571Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"php","name":"frankenphp","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.13.4","versionType":"semver"},{"version":"1.13.4","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/dunglas/frankenphp","packageIdentity":{"ecosystem":"Go","name":"github.com/dunglas/frankenphp"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-128019"}],"remediation":[],"references":["https://github.com/php/frankenphp/security/advisories/GHSA-8386-64gm-3m8q","https://github.com/php/frankenphp/commit/72f9366de07093ba3f524af3e6c73451012e5199","https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-information-disclosure-via-per-request-environment-variable-leak"],"sources":[{"name":"CVE","id":"CVE-2026-128019","modified":"2026-11-13T09:34:08.571Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-128019"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8}],"sourceAffected":[],"observedAt":"2026-11-13T12:49:42.988Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-14T08:41:06.214Z","attemptedAt":"2026-11-14T08:41:06.214Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T08:35:32.845Z","attemptedAt":"2026-11-14T08:35:32.845Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-14T08:25:31.434Z","attemptedAt":"2026-11-14T08:25:31.434Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-14T08:25:31.268Z","attemptedAt":"2026-11-14T08:25:31.268Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-128019","url":"https://www.first.org/epss/","probability":0.00315,"percentile":0.24792,"date":"2026-11-13","checkedAt":"2026-11-14T08:25:31.268Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125083","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125083","modified":"Nov 13, 2026, 9:34:08 AM","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-14T08:25:31.434Z"},{"source":"GitHub Advisory Database","id":"GHSA-67qw-5wvh-x639","url":"https://github.com/advisories/GHSA-67qw-5wvh-x639","modified":"2026-11-13T12:31:37Z","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-11-14T08:35:32.845Z"},{"source":"NVD","id":"CVE-2026-128019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128019","modified":"2026-11-13T10:18:07.420","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-14T08:41:06.214Z"},{"source":"NVD","id":"CVE-2026-128019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128019","modified":"2026-11-13T10:18:07.420","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-11-14T08:41:06.214Z"}],"aiSummary":{"text":"FrankenPHP before 1.13.4 has an information disclosure vulnerability that leaks per-request environment variables into later requests on the same PHP thread, allowing attackers to read sensitive values. The vulnerability requires access to the same PHP thread. The impact is that applications may act on another user's routing, tenant, or authorization values.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T13:56:11.243Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-128019"}]}}