Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in process-wide environment variables using os.environ without proper session isolation. Because Streamlit serves multiple concurrent users from a single Python process, credentials provided by one user remain accessible to subsequent unauthenticated users. An attacker can exploit this issue to retrieve sensitive information such as GitHub Personal Access Tokens or LLM API keys, potentially leading to unauthorized access to private resources and financial abuse.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-30 | 1 | Disclosure1 |
| 2026-03-31 | 2 | Disclosure2 |
CVE-2026-29872 A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affec… https://www.cve.org/CVERecord?id=CVE-2026-29872
Post summary
The text reports CVE-2026-29872 as a cross‑session information disclosure in the awesome‑llm‑apps project, yet it includes no PoC, exploit, patch, or evidence of active exploitation.
🚨*CVE* CVE-2026-29872 A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affec… https://www.cve.org/CVERecord?id=CVE-2026-29872 ----- Traducción: CVE-2026-29872 Exi… http://infoflow.cloud`
Post summary
The post announces a newly disclosed CVE‑2026‑29872, outlining a cross‑session information disclosure flaw identified in a specific commit of the awesome‑llm‑apps project. No exploitation details, patches, or PoC are provided.
🟠 CVE-2026-29872 - High A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affected Streamlit-based GitHu... https://www.thehackerwire.com/vulnerability/CVE-2026-29872/ https://t.co/GB3uch8BvY
Post summary
A new CVE-2026-29872 exposing cross‑session information disclosure in awesome‑llm‑apps was announced with technical details and a commit reference, but no exploit, PoC, or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | theunwindai | awesome_llm_apps | 2026-01-19 | - | - |