{"id":"3c90542cc1c1f4ee","repo":"apache/kafka","slug":"could-not-read-environment-variables","errorCode":null,"errorMessage":"Could not read environment variables","messagePattern":"Could not read environment variables","errorType":"validation","errorClass":"ConfigException","httpStatus":null,"severity":"error","filePath":"clients/src/main/java/org/apache/kafka/common/config/provider/EnvVarConfigProvider.java","lineNumber":118,"sourceCode":"            throw new ConfigException(\"Path is not supported for EnvVarConfigProvider, invalid value '\" + path + \"'\");\n        }\n\n        if (keys == null) {\n            return new ConfigData(filteredEnvVarMap);\n        }\n\n        Map<String, String> filteredData = new HashMap<>(filteredEnvVarMap);\n        filteredData.keySet().retainAll(keys);\n\n        return new ConfigData(filteredData);\n    }\n\n    private Map<String, String> getEnvVars() {\n        try {\n            return System.getenv();\n        } catch (Exception e) {\n            log.error(\"Could not read environment variables\", e);\n            throw new ConfigException(\"Could not read environment variables\");\n        }\n    }\n}\n","sourceCodeStart":100,"sourceCodeEnd":122,"githubUrl":"https://github.com/apache/kafka/blob/c31c9215e131f8c17e79f8901b48c13ee6aa8e7a/clients/src/main/java/org/apache/kafka/common/config/provider/EnvVarConfigProvider.java#L100-L122","documentation":"Thrown as ConfigException by EnvVarConfigProvider.getEnvVars() (invoked from the no-arg constructor) when System.getenv() raises any Exception. The catch is broad (Exception) because environment access is normally infallible on the JVM; a throw indicates a serious system-level problem. The exception is logged with full stack trace before being wrapped.","triggerScenarios":"Constructing new EnvVarConfigProvider() when System.getenv() throws, which is rare and typically tied to a misbehaving SecurityManager, a corrupted process environment, or a JVM/OS-level fault. Most call sites instantiate the provider indirectly through the ConfigTransformer during config-provider setup.","commonSituations":"A restrictive SecurityManager denying access to environment variables (deprecated but possible on legacy JVMs). Corrupted process environment block. Native interop or agent interfering with getenv. Very rarely, a JVM bug in environment parsing on the host OS.","solutions":["Inspect the ERROR log 'Could not read environment variables' and its stack trace to identify the underlying cause.","If a SecurityManager is installed, grant the required permission or remove the manager (note: SecurityManager is deprecated/removed in modern JDKs).","Switch to the EnvVarConfigProvider(Map) constructor by passing env vars explicitly as a workaround.","Restart on a known-good JVM version if the cause is a JVM/OS environment bug."],"exampleFix":"// before\nEnvVarConfigProvider p = new EnvVarConfigProvider();\n\n// after (workaround: inject env map explicitly)\nEnvVarConfigProvider p = new EnvVarConfigProvider(System.getenv());","handlingStrategy":"try-catch","validationCode":"// Limited pre-validation possible (System.getenv can throw at any time).\n// Best effort: use the Map-based constructor when you control the env source:\nMap<String, String> snapshot;\ntry {\n    snapshot = System.getenv();\n} catch (SecurityException se) {\n    snapshot = Collections.emptyMap(); // or fail loudly per policy\n}\nEnvVarConfigProvider p = new EnvVarConfigProvider(snapshot);","typeGuard":null,"tryCatchPattern":"try {\n    EnvVarConfigProvider p = new EnvVarConfigProvider();\n} catch (ConfigException e) {\n    if (e.getMessage().equals(\"Could not read environment variables\")) {\n        // fall back to the Map constructor with an explicit env map, or disable the provider\n    } else { throw e; }\n}","preventionTips":["Ensure the runtime SecurityManager / container seccomp profile permits System.getenv(); grant the permission in policy files if needed.","In sandboxed or custom classloader setups, prefer new EnvVarConfigProvider(envMap) so env access is explicit and testable.","Log the original exception cause (it is captured in the provider's log) when diagnosing why getenv failed."],"tags":["config-provider","env-config-provider","jvm","environment"],"analyzedSha":"c31c9215e131f8c17e79f8901b48c13ee6aa8e7a","analyzedAt":"2026-08-03T12:34:05.770Z","schemaVersion":2}