---

CVE-2026-22015 – Serverless Function Environment Variable Injection via Event

Program Code (Python Lambda sim)

# lambda_env_inject.py - Vulnerable function that reads env from event
import os, json

def handler(event, context):
    # The event contains environment variable overrides (debug feature)
    for key, value in event.get('env', {}).items():
        os.environ[key] = value
    return os.environ.get('SECRET', 'not set')

CVE-2026-22015 – Serverless Function Environment Variable Injection via Event

Overview

A serverless function trusts the incoming event to set environment variables, intended for debugging. An attacker can inject arbitrary environment variables, overriding secrets and altering the function’s behavior.

Vulnerability Details

• Type: Injection / Privilege Escalation
• Impact: Credential theft, logic corruption.
• Root Cause: The function does not validate the source of the event; user‑controlled data merges into os.environ.

Exploit Demonstration

Run the function locally and invoke with the malicious event:

python lambda_env_inject.py

The secret is overwritten to "attacker_controlled".