EIP-2026-104274

This exploit leverages a metadata API endpoint in Hasura GraphQL 2.2.0 to disclose arbitrary environment variables by abusing the 'url_from_env' field in a remote schema definition, which leaks the variable's value in an error message.