Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Airbrake Module Exposes Sensitive Environment Variables Over HTTP

CVE-2016-10530 · published 8 years ago
Summary

Airbrake module versions 0.3.8 and earlier send environment variables over the internet, potentially exposing secret keys and other sensitive information. This is a security risk because sensitive data can be intercepted by unauthorized users. To fix this issue, update to a newer version of the Airbrake module that uses HTTPS to secure sensitive data.

What to do
  • Update sgray5 airbrake to version 0.4.0.
Affected software
Ecosystem VendorProductAffected versions
npm sgray5 airbrake < 0.4.0
Fix: upgrade to 0.4.0
– airbrake airbrake <= 0.3.8
cpe:2.3:a:airbrake:airbrake:*:*:*:*:*:node.js:*:*
Original advisory text
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user cou...
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS.
References
Severity
5.9 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-310Cryptographic Issues
Timeline
Published31 May 2018
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-856x-cp3q-47vg · GHSA
CVE-2016-10530 · NVD
Track software like this
Free during beta