# CVE-2026-85391: Peppermint hardcoded JWT signing secret in docker-compose.yml

Source: https://junglewise.ai/threats/cve-2026-85391-peppermint-hardcoded-jwt-signing-secret-in-docker-compose-yml  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85391 · Severity: critical · CVSS 9.8 · Published 2026-09-03

Peppermint is an open-source issue tracking and help desk solution. The application contains a hardcoded JWT (JSON Web Token) signing secret in its docker-compose.yml configuration file, which is publicly visible in the source code repository. An attacker can use this published secret to forge valid authentication tokens for any user account without needing credentials, gaining full access to the system and all customer data.

Technologies: [Peppermint Lab Peppermint](https://junglewise.ai/threats/technologies/peppermint). Vendors: [Peppermint Lab](https://junglewise.ai/threats/vendors/peppermint-lab).

## Quick answers

**Is CVE-2026-85391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85391 being exploited in the wild.

**How severe is CVE-2026-85391?** Critical severity, with a CVSS score of 9.8, published 3 September 2026.

**Which products and versions are affected?** Peppermint Lab Peppermint through 0.5.5.

**Is there a fix for CVE-2026-85391?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85391 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85391?** Check whether you run Peppermint Lab Peppermint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cryptographic key exposure caused by hardcoding the JWT signing secret in the docker-compose.yml file, which is stored in the public GitHub repository. The JWT verification function in apps/api/src/lib/jwt.ts uses this exposed secret (via the SECRET environment variable) to sign and verify tokens. An unauthenticated attacker can extract the secret from the repository, use it to mint valid JWT tokens for arbitrary user IDs, and gain unauthorized access to protected API endpoints without credentials. Peppermint through version 0.5.5 is affected; the project was archived on July 17, 2026, and no patched versions are expected to be released.

## Affected products

- Peppermint Lab Peppermint through 0.5.5

## Timeline

- 2026-09-03: disclosed

## References

- [https://github.com/Peppermint-Lab/peppermint](https://github.com/Peppermint-Lab/peppermint)
- [https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/lib/jwt.ts](https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/lib/jwt.ts)

## Related threats

- [Peppermint missing authorization in time entries and attachments](https://junglewise.ai/threats/cve-2026-111353-peppermint-through-0-5-5-contains-a-missing-authorization)
- [Peppermint authorization bypass in logout endpoint](https://junglewise.ai/threats/cve-2026-85392-peppermint-authorization-bypass-in-logout-endpoint)
- [Peppermint Lab Peppermint broken access control in OIDC configuration](https://junglewise.ai/threats/cve-2026-72561-peppermint-lab-peppermint-broken-access-control-in-oidc)
- [Peppermint Lab Peppermint broken access control in role checks](https://junglewise.ai/threats/cve-2026-72555-peppermint-lab-peppermint-broken-access-control-in-role-checks)