CVE-2026-123965

A prompt could expose cloud configuration credentials in Jet Admin

Jet Admin · Jet Admin Cloud Platform AI service

First documented disclosure · Review checkpoint

Summary

The AI service could access environment configuration beyond the requesting account’s intended scope. Sensitive configuration and credentials could be disclosed.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The AI service could access environment configuration beyond the requesting account’s intended scope.

Conditions required

A remote user held a free Jet Admin account.

Potential impact

Sensitive configuration and credentials could be disclosed.

Affected versions and configurations

CISA lists all cloud platform versions.

Fix and mitigation status

CISA dates a platform-side sandbox mitigation to around October 29, 2026. Its advisory lists no customer-installable fix.

Practical next steps

Confirm the hosted mitigation with Jet Admin and rotate credentials if review identifies exposure.

Operating lesson

Keep cloud configuration and credentials outside the files an AI service can inspect.

Evidence and limits

The sandbox date is approximate. CISA published its advisory on November 13 and did not report a victim. The advisory and CVE record were published on 2026-11-13.

Sources