CVE-2026-76805 in Nuclei
Summary
by MITRE • 09/22/2026
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor in one protocol step to be reinterpreted as template syntax in a later fuzz step. This vulnerability is an incomplete fix for CVE-2026-41645: the prior remediation made expressions.Evaluate() single-pass within one call but did not prevent DAST/fuzz callers from evaluating substituted output again. When -env-vars is enabled, a malicious scan target can return marker-shaped content that resolves against the template variable map and discloses scanner-host environment variables such as credentials, API keys, or tokens. The vulnerability requires a multi-step DAST or fuzz template, response data reused through an internal extractor, and explicit environment-variable expansion; users who do not enable -env-vars are not affected by the sensitive-information disclosure. This issue is fixed in version 3.10.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified as CVE-2026-41645 represents a critical information disclosure flaw within Nuclei, an open-source vulnerability scanner that utilizes a YAML-based domain-specific language for defining detection templates. The root cause lies in the handling of dynamic payload substitution and evaluation logic within the DAST fuzzing engine, specifically in the file pkg/fuzz/parts.go across versions 3.0.0 through 3.10.0. While an earlier remediation attempt addressed a similar issue by ensuring that expressions.Evaluate() performed only single-pass evaluations during standard template execution, this fix was incomplete regarding the DAST and fuzzing subsystems. The flaw arises because these specific callers were not restricted from re-evaluating substituted runtime data after it had been captured as response content. This architectural oversight creates a scenario where dynamic output generated by one protocol step can be inadvertently interpreted as executable template syntax in subsequent steps, effectively bypassing the intended single-pass security boundary established for standard expression evaluation.
The operational impact of this vulnerability is severe when specific configuration flags are enabled during scanning operations. The exploit requires a multi-step DAST or fuzzing template that utilizes an internal extractor to capture response content from an initial interaction with the target server. If the scanner is launched with the -env-vars flag, which enables environment variable expansion within templates, a maliciously crafted scan target can return marker-shaped content designed to resolve against the template variable map. When this captured content undergoes re-evaluation in later fuzzing steps, it triggers the resolution of sensitive host-side variables rather than being treated as static text data. This mechanism allows an attacker controlling or influencing the response from a scanned service to extract confidential information directly from the scanner's execution environment.
The specific types of credentials at risk include API keys, authentication tokens, database passwords, and other secrets stored in the environment variables of the machine running Nuclei. Because the vulnerability relies on the re-interpretation of captured HTTP responses as template syntax, it effectively turns a standard web application into an active data exfiltration vector for the scanning infrastructure itself. This is particularly dangerous in automated security pipelines where scanners are often deployed with elevated privileges or access to sensitive configuration files and environment variables to facilitate comprehensive testing across multiple services. The successful exploitation of this flaw does not require remote code execution on the target but rather leverages the trust relationship between the scanner's template engine and its runtime environment, leading to a direct compromise of the scanning host's security posture through information leakage.
From a classification perspective, this vulnerability aligns with CWE-209, which covers the generation of error messages containing sensitive information, although in this case, the exposure is not an explicit error message but rather the unintended resolution and transmission of environment variable values via normal response processing channels. It also relates to CWE-78, Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), as it involves the injection of external data into a context where it is interpreted as code or syntax by the application's internal engine. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1059, Command and Scripting Interpreter, specifically through dynamic evaluation mechanisms, and potentially T1537, Transfer Data to Cloud Account, if the exfiltrated data is transmitted back to a remote server controlled by the attacker via subsequent template steps. The vulnerability highlights the risks associated with complex templating engines that allow recursive or multi-pass evaluations of user-controlled input without strict sanitization boundaries between data capture and syntax interpretation phases.
Mitigation for this issue requires immediate upgrading to Nuclei version 3.10.0, where the DAST and fuzzing subsystems have been patched to prevent the re-evaluation of captured response content as template syntax. For organizations unable to upgrade immediately due to operational constraints, a critical defensive measure is to disable the -env-vars flag during scanning operations. Since the vulnerability explicitly requires environment variable expansion to resolve sensitive markers into actual credential values, disabling this feature effectively neutralizes the information disclosure vector even if the underlying code flaw remains present in older versions. Additionally, security teams should audit their Nuclei templates for any custom DAST or fuzzing scripts that rely on internal extractors feeding data back into subsequent steps, ensuring that such workflows are reviewed against updated best practices once the patch is applied. Regular updates to vulnerability scanning tools are essential not only to detect flaws in target systems but also to protect the integrity of the security infrastructure itself from being weaponized through template injection and environment variable leakage vulnerabilities.