CVE-2026-29872: awesome-llm-apps Information Disclosure

CVE-2026-29872 Overview

A cross-session information disclosure vulnerability exists in the awesome-llm-apps project that allows attackers to retrieve sensitive credentials from other users' sessions. The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in process-wide environment variables using os.environ without proper session isolation. Because Streamlit serves multiple concurrent users from a single Python process, credentials provided by one user remain accessible to subsequent unauthenticated users.

Critical Impact

An attacker can exploit this vulnerability to retrieve sensitive information such as GitHub Personal Access Tokens or LLM API keys, potentially leading to unauthorized access to private repositories and financial abuse through API key theft.

Affected Products

• awesome-llm-apps project (commit e46690f99c3f08be80a9877fab52acacf7ab8251)
• Streamlit-based GitHub MCP Agent component
• Deployments using shared Python process architecture

Discovery Timeline

• 2026-03-30 - CVE CVE-2026-29872 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-29872

Vulnerability Analysis

This vulnerability stems from improper session isolation in the awesome-llm-apps Streamlit application. The application stores user-supplied credentials, including GitHub Personal Access Tokens and LLM API keys, directly in process-wide environment variables via os.environ. This design flaw becomes critical in Streamlit's execution model, where a single Python process handles requests from multiple concurrent users.

When a user submits their API credentials through the GitHub MCP Agent interface, these tokens are written to the shared process environment. Any subsequent user connecting to the same application instance can access these environment variables, effectively retrieving another user's sensitive credentials without any authentication.

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), reflecting the core issue of inadequate access controls on sensitive data.

Root Cause

The root cause lies in the architectural decision to use process-wide environment variables (os.environ) for storing per-user session data. Streamlit applications are designed to serve multiple users from a single Python process, making environment variables an inappropriate storage mechanism for user-specific secrets. The lack of session isolation means credentials persist beyond the original user's session and become accessible to other users sharing the same process.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability through the following attack flow:

1. The attacker accesses the publicly available Streamlit-based GitHub MCP Agent
2. A legitimate user has previously submitted their GitHub Personal Access Token or LLM API key
3. The attacker reads the process environment variables through the application interface or by exploiting the shared process context
4. The attacker obtains the victim's credentials and can use them for unauthorized access to private GitHub repositories or to abuse paid LLM API services

The vulnerability requires no privileges and has low attack complexity, making it particularly dangerous for public-facing deployments of the affected application.

Detection Methods for CVE-2026-29872

Indicators of Compromise

• Unexpected access patterns to GitHub repositories using stolen Personal Access Tokens
• Unusual API consumption spikes on LLM service accounts indicating potential credential theft
• Multiple authentication events from disparate geographic locations using the same credentials
• Log entries showing environment variable access from different session contexts

Detection Strategies

• Monitor Streamlit application logs for patterns indicating environment variable enumeration
• Implement application-level logging to track credential submission and access events
• Analyze GitHub audit logs for suspicious repository access using tokens provisioned through the affected application
• Review LLM API provider dashboards for anomalous usage patterns that may indicate stolen API keys

Monitoring Recommendations

• Enable verbose logging on all Streamlit deployments running the awesome-llm-apps GitHub MCP Agent
• Set up alerts for GitHub Personal Access Token usage from unexpected IP addresses
• Monitor cloud costs associated with LLM API services for sudden increases indicating credential abuse
• Implement session-aware logging to correlate user activities with credential access patterns

How to Mitigate CVE-2026-29872

Immediate Actions Required

• Immediately rotate all GitHub Personal Access Tokens that have been used with the affected application
• Revoke and regenerate any LLM API keys submitted through the GitHub MCP Agent
• Take affected Streamlit deployments offline until proper session isolation can be implemented
• Audit access logs for signs of credential theft and unauthorized resource access

Patch Information

As of the last NVD update on 2026-04-01, users should check the GitHub security research repository for the latest remediation guidance. The vulnerable commit is e46690f99c3f08be80a9877fab52acacf7ab8251 dated 2026-01-19. Organizations should update to a patched version once available or implement the workarounds below.

Workarounds

• Replace os.environ storage with Streamlit's built-in session state (st.session_state) for per-user credential storage
• Implement proper session isolation by storing credentials in encrypted, session-scoped storage mechanisms
• Deploy the application in single-user mode or use containerization to isolate each user session
• Use external secrets management services (e.g., HashiCorp Vault) with per-session authentication rather than environment variables

# Example: Deploy with session isolation using container-per-user
docker run -d --name streamlit-session-${USER_SESSION_ID} \
  -e STREAMLIT_SERVER_PORT=8501 \
  -e STREAMLIT_SERVER_ADDRESS=0.0.0.0 \
  awesome-llm-apps:latest