Description

In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-11-06T11:17:11.003Z",
  "pubdate": "2026-11-06T11:17:11.003Z",
  "executiveSummary": "JetBrains Junie CLI versions prior to 26.6.29 are affected by a sensitive information disclosure vulnerability within the session event logging mechanism.\nThe vulnerability involves the unintentional logging of sensitive environment variables, which may include API keys, authentication tokens, or other configuration secrets, into plain-text logs.\nSuccessful exploitation allows an unauthorized party with read access to these log files to gain access to sensitive credentials, potentially leading to unauthorized account access, lateral movement, or escalation of privilege.\nThis issue impacts all environments where Junie CLI is deployed, regardless of specific user privilege levels, as the leakage occurs during standard operational event logging.\nThe risk is categorized as high, as it facilitates credential theft without requiring active interaction with the live application, relying solely on access to persistent log storage.",
  "technicalDetails": "The vulnerability resides in the internal logging architecture of the JetBrains Junie CLI, specifically where session event metadata is captured and persisted to local storage.\nDuring the session initialization or runtime execution phase, the CLI inadvertently includes the entire process environment block or specific sensitive keys within the event logs generated for audit or telemetry purposes.\nThe root cause is a failure in the application's sanitization logic, which fails to mask or exclude sensitive environment variables before writing the session telemetry data to the log files.\nExploitation does not require specialized technical expertise; an attacker merely needs access to the file system where the Junie CLI session logs are stored. This may occur through shared workstation access, insecure log aggregation services, or compromised backup repositories.\nThe attack flow proceeds as follows: 1) The Junie CLI initializes, inheriting environment variables from the parent shell. 2) The logging subsystem captures session events and serializes the environment context without filtering. 3) The telemetry is written to a plain-text log file. 4) An attacker reads the log file to extract sensitive credentials contained within the logged environment variables.\nThe exposure is persistent, meaning logs generated prior to the patch remain vulnerable until rotated or manually purged. The vulnerability is present across all versions preceding 26.6.29 and affects any operating system where the CLI is utilized.\nPost-exploitation, an attacker can utilize the harvested credentials to impersonate the user, access integrated development environments, or authenticate against downstream cloud services and internal APIs that the user had previously configured within their local environment."
}