CVE-2026-76805 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
A malicious scan target can disclose scanner-host environment variables if the -env-vars flag is enabled during DAST or fuzz operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-76805?
CVE-2026-76805 is a medium-severity vulnerability in projectdiscovery nuclei, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor in one protocol step to be reinterpreted as template syntax in a later fuzz step. This vulnerability is an incomplete fix for CVE-2026-41645: the prior remediation made expressions.Evaluate() single-pass within one call but did not prevent DAST/fuzz callers from evaluating substituted output again. When -env-vars is enabled, a malicious scan target can return marker-shaped content that resolves against the template variable map and discloses scanner-host environment variables such as credentials, API keys, or tokens. The vulnerability requires a multi-step DAST or fuzz template, response data reused through an internal extractor, and explicit environment-variable expansion; users who do not enable -env-vars are not affected by the sensitive-information disclosure. This issue is fixed in version 3.10.0.
Weakness: CWE-200
Which versions are affected by CVE-2026-76805?
5 open source packages ship an affected version, including github.com/projectdiscovery/nuclei/v3, github.com/projectdiscovery/nuclei and github.com/projectdiscovery/nuclei/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectdiscovery/nuclei/v3 Go | From 3.0.0 | 3.10.0 |
github.com/projectdiscovery/nuclei/v3 Go | From 3.0.0 | 3.10.0 |
github.com/projectdiscovery/nuclei/v3 Go | From 3.0.0 | 3.10.0 |
github.com/projectdiscovery/nuclei Go | All versions | None |
github.com/projectdiscovery/nuclei/v2 Go | All versions | None |
How do I fix CVE-2026-76805?
Upgrade github.com/projectdiscovery/nuclei/v3 to 3.10.0 or later.
Is CVE-2026-76805 being exploited?
There is no known exploitation of CVE-2026-76805 in the wild and no public exploit code.
Sources
Also known as GHSA-jpvm-9frm-hjcq, GO-2026-6571.