Workflow Engine $(env.VAR) Interpolation Bypasses Policy Causing Credential Leak (CVE-2026-67427)

Vulnerability Overview Vulnerability Name: interpolation allows reading any env secret, despite being denied. Vulnerability Description: The capability policy denies and modules by default because they read arbitrary host environment variables (API keys, DSNs) and pose a risk of secret leakage. However, the workflow engine's variable resolver expands for any environment variable (without whitelist or policy checks), bypassing the capability policy block. The resolved secrets can be exfiltrated via any allowed module. Scope Affected Versions: Fixed Version: CVSS Score: 8.6 / 10 CVSS Vector: CVE ID: CVE-2026-67427 Weaknesses: - CWE-522 - CWE-666 - CWE-693 Remediation Recommended Fix: Apply the same capability policy to as is applied to the module. Enforce an env access policy during engine interpolation and module execution. Alternatively, remove and require env values to be passed explicitly at workflow startup. POC Code Output Impact Reading of any host environment variables (such as cloud keys, tokens, DSNs), which operators rely on the capability policy to protect. Exfiltration via external requests processed by allowed modules (the SSRF guard allows the attacker's public host). Accessible via the Workflow API and MCP agent server. Recommended Fixes Apply the same capability policy to as is applied to the module. Enforce an env access policy during engine interpolation and module execution. Alternatively, remove and require env values to be passed explicitly at workflow startup.

Goal Reached Thanks to every supporter — we hit 100%!

Workflow Engine $(env.VAR) Interpolation Bypasses Policy Causing Credential Leak (CVE-2026-67427)

More from this source