CVE-2026-76805: Nuclei Scanner Information Disclosure Flaw

CVE-2026-76805 Overview

CVE-2026-76805 affects Nuclei, a widely used vulnerability scanner built on a YAML-based domain-specific language (DSL). Versions from 3.0.0 up to (but not including) 3.10.0 contain a double-evaluation flaw in the Dynamic Application Security Testing (DAST) and fuzz payload path within pkg/fuzz/parts.go. A malicious scan target can return marker-shaped content that gets reinterpreted as template syntax during a later fuzz step. When the scanner is run with -env-vars enabled, this behavior can disclose environment variables from the scanner host, including credentials, API keys, and tokens. The issue is classified under [CWE-200] Information Exposure and is fixed in Nuclei 3.10.0.

Critical Impact
Malicious targets can exfiltrate scanner-host environment variables such as credentials, API keys, and tokens when -env-vars is enabled in multi-step DAST or fuzz templates.

Affected Products

ProjectDiscovery Nuclei versions 3.0.0 through 3.9.x
Nuclei DAST and fuzz template workflows using internal: true extractors
Nuclei deployments invoked with the -env-vars flag

Discovery Timeline

2026-09-22 - CVE-2026-76805 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-76805

Vulnerability Analysis

The vulnerability is an incomplete fix for CVE-2026-41645. The prior remediation made expressions.Evaluate() single-pass within a single call. It did not, however, prevent DAST and fuzz callers from evaluating substituted output a second time. Response content captured by an internal: true extractor in one protocol step can be reinterpreted as template syntax in a subsequent fuzz step. This produces a second evaluation pass over attacker-controlled data. When -env-vars expansion is enabled, the reinterpreted content resolves against the template variable map. Values such as {{env "AWS_SECRET_ACCESS_KEY"}} embedded in a target response can then be rendered using the scanner host's environment.

Root Cause

The root cause is a missing boundary between untrusted response data and trusted template rendering in pkg/fuzz/parts.go. Substituted runtime data flowed back into an evaluator that treated {{...}} markers as executable template expressions. The fix introduces a dedicated render package and a matcher-side handler (pkg/operators/matchers/dsl_string_markers.go) that safely processes DSL string markers without re-entering the expression evaluator.

Attack Vector

Exploitation requires three preconditions: a multi-step DAST or fuzz template, response data reused through an internal: true extractor, and the -env-vars flag enabled on the scanner. A malicious HTTP server returns a body containing marker-shaped payloads such as {{env "SECRET"}}. The extractor captures the payload, and the next fuzz step evaluates it a second time, resolving the marker against the scanner host's environment. The disclosed data can be reflected back to the attacker through subsequent request parameters or matcher output.

// Patch: pkg/fuzz/parts.go — remove direct expression evaluation from the
// fuzz payload path and route rendering through a dedicated boundary.
 	"strings"
 
 	"github.com/projectdiscovery/nuclei/v3/pkg/fuzz/component"
-	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/expressions"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/generators"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/render"
 	"github.com/projectdiscovery/nuclei/v3/pkg/types"
 	"github.com/projectdiscovery/retryablehttp-go"
 	sliceutil "github.com/projectdiscovery/utils/slice"

Source: GitHub Nuclei Commit ccbfb12

// Patch: pkg/operators/matchers/dsl_string_markers.go — new safe handler
// that parses DSL markers without triggering a second evaluation pass.
package matchers

import (
	"fmt"
	"regexp"
	"sort"
	"strings"

	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/expressions"
	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/render"
)

var dslStringMarkerRegex = regexp.MustCompile(`\{\{([^{}]+)\}\}`)

// dslStringMarker represents a span of an unresolved DSL expression within a
// string literal.
type dslStringMarker struct {
	start int
	end   int
	expr  string
	quote byte
}

Source: GitHub Nuclei Pull Request 7499

Detection Methods for CVE-2026-76805

Indicators of Compromise

Nuclei processes launched with the -env-vars flag combined with DAST or fuzz templates.
Outbound HTTP requests from scanner hosts containing environment-variable values (for example, strings matching AKIA, ghp_, or private key headers) in query parameters or request bodies.
Response payloads from scanned targets containing literal {{env ...}}, {{...}}, or Nuclei DSL marker substrings.
Nuclei template runs using internal: true extractors chained into subsequent fuzz steps.

Detection Strategies

Inspect Nuclei command-line arguments and CI/CD pipeline definitions for use of -env-vars on versions below 3.10.0.
Correlate scanner outbound traffic with the scanner host's environment variable inventory to identify reflected secrets.
Alert on HTTP responses ingested by scanners that contain unrendered {{...}} markers followed by follow-up requests carrying resolved values.

Monitoring Recommendations

Log Nuclei binary invocations, including flags and template paths, on all hosts running scans.
Monitor egress from CI runners and scanner nodes for credential-shaped strings using data-loss prevention (DLP) rules.
Track the installed Nuclei version across build agents and security tooling hosts and alert on any release below 3.10.0.

How to Mitigate CVE-2026-76805

Immediate Actions Required

Upgrade Nuclei to version 3.10.0 or later on every host, container image, and CI/CD runner.
Remove the -env-vars flag from scanner invocations unless it is strictly required by a template.
Rotate credentials, API keys, and tokens present in the scanner host environment if -env-vars was used against untrusted targets.
Audit DAST and fuzz templates that rely on internal: true extractors chained across steps.

Patch Information

ProjectDiscovery released the fix in Nuclei 3.10.0. The patch introduces a template rendering boundary that prevents substituted runtime data from being re-evaluated as DSL expressions. See the GitHub Security Advisory GHSA-jpvm-9frm-hjcq and the Nuclei v3.10.0 Release Notes for full details.

Workarounds

Disable -env-vars expansion in all scanner configurations until upgrading to 3.10.0.
Restrict scans to trusted targets and avoid running DAST or fuzz templates against untrusted external endpoints.
Run Nuclei in isolated containers with a minimal environment that contains no production secrets.
Remove or refactor multi-step templates that reuse response data through internal: true extractors.

bash

# Configuration example: upgrade Nuclei and run without environment variable expansion
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v3.10.0

# Verify installed version
nuclei -version

# Recommended invocation: omit -env-vars and isolate the runtime
docker run --rm --read-only --tmpfs /tmp \
  -e HOME=/tmp \
  projectdiscovery/nuclei:v3.10.0 \
  -u https://target.example.com \
  -t dast/