CVE-2026-33886: Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

March 26, 2026 (updated March 27, 2026)

A control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content.

References

github.com/advisories/GHSA-gcqf-5x9f-hq7f
github.com/statamic/cms
github.com/statamic/cms/security/advisories/GHSA-gcqf-5x9f-hq7f
nvd.nist.gov/vuln/detail/CVE-2026-33886

Code Behaviors & Features

Detect and mitigate CVE-2026-33886 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →