What is the CVSS score of CVE-2026-29872?

CVE-2026-29872 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Python CVE-2026-29872

EUVD-2026-17141 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-03-30 mitre

GHSA-qx64-h3hh-3vhj

Python Information Disclosure Authentication Bypass

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 30, 2026 - 17:36 euvd

EUVD-2026-17141

Analysis Generated

Mar 30, 2026 - 17:36 vuln.today

CVE Published

Mar 30, 2026 - 00:00 nvd

HIGH 8.2

DescriptionCVE.org

A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in process-wide environment variables using os.environ without proper session isolation. Because Streamlit serves multiple concurrent users from a single Python process, credentials provided by one user remain accessible to subsequent unauthenticated users. An attacker can exploit this issue to retrieve sensitive information such as GitHub Personal Access Tokens or LLM API keys, potentially leading to unauthorized access to private resources and financial abuse.

AnalysisAI

Cross-session credential leakage in awesome-llm-apps Streamlit-based GitHub MCP Agent allows unauthenticated users to retrieve previously stored API tokens and secrets from process-wide environment variables, compromising GitHub Personal Access Tokens and LLM API keys across concurrent session boundaries. The vulnerability stems from improper session isolation in a multi-user Streamlit application that persists credentials in os.environ without clearing them between user sessions, enabling attackers to escalate privileges and access private resources without authentication.

Technical ContextAI

The vulnerability exists in a Streamlit-based application that interfaces with GitHub via the Model Context Protocol (MCP). Streamlit is a Python framework designed for rapid data application development that runs a single Python process serving multiple concurrent users via websocket connections. The flaw occurs because user-supplied API credentials are stored directly in process-wide environment variables (os.environ) without implementing session-scoped storage or cleanup mechanisms. When one user provides credentials for GitHub API access or LLM authentication, these values persist in the process memory and environment variable dictionary. Subsequent users connecting to the same Streamlit server instance can access these credentials, effectively bypassing the application's implicit per-user isolation expectations. This is a classic case of CWE-200 (Information Exposure) compounded by CWE-384 (Session Fixation) due to the shared process architecture and lack of credential scoping to individual sessions. The vulnerability highlights a fundamental architecture mismatch: Streamlit's single-process, multi-user design is incompatible with naive credential storage patterns that assume process isolation.

RemediationAI

The primary remediation is to implement proper session-scoped credential storage rather than process-wide environment variables. Developers should refactor credential handling to use Streamlit's session_state dictionary (st.session_state) or implement a secure per-session credential cache that is cleared when sessions terminate. A temporary workaround is to deploy each Streamlit user session in an isolated Python process (e.g., using Docker containers per user or a load-balanced multi-process Streamlit server configuration), though this is architecturally inefficient. Immediately patch to a version that implements session isolation; check the security-research repository referenced (https://github.com/lilmingwa13/security-research/blob/main/CVE-2026-29872.md) for patched commit hashes or pull requests. As a stopgap measure, clear os.environ of sensitive keys at session end, though this does not prevent cross-session leakage during concurrent sessions. Users should rotate all API credentials (GitHub tokens, LLM keys) that may have been exposed in affected deployments and enable multi-factor authentication on associated accounts.