Prompt injection in Jet Admin Cloud Platform exposes .env files

A prompt injection vulnerability in Jet Admin Cloud Platform allowed remote attackers with free accounts to expose sensitive .env configuration files and exfiltrate credentials. The vulnerability was mitigated via a sandbox component around October 29, 2026.

Disclosed 13 November 2026 · Record updated 13 November 2026

Impact

Exposure of sensitive .env configuration files and exfiltration of critical credentials for affected users

Our coverage

A hacker's hand slips a forged instruction card into a filing cabinet's slot, and confidential folders tumble out onto the floor, scattered and exposed.

Vulnerabilities

Prompt injection flaw exposed .env files in Jet Admin platform

A CVE published on 13 November 2026 says attackers with free accounts could pull configuration files and credentials from Jet Admin Cloud Platform.

13 Nov 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-123965