Known Issue: EnvironmentVariableFetcher fails with default security settings in FME 2026.2 and backports

Issue

In FME 2026.2 and specified versions containing backported security updates, the EnvironmentVariableFetcher transformer may fail without throwing an error message. 

FME Hub items using this transformer may also be impacted.

Cause

As a result of security changes, the ability to specify some TCL and FME Functions in parameter and attribute values has been disabled or reduced, impacting some transformers and advanced scripting features.  

This applies to the updated versions and instances that have been patched according to the instructions in the advisory: 
 

FME Form versions:

• 2026.2
• 2026.1.0.1, 2026.1.1.1, 2026.1.2.1
• 2025.2.0.1, 2025.2.1.1, 2025.2.2.1, 2025.2.3.1, 2025.2.4.2
• 2025.1.0.2, 2025.1.1.1, 2025.1.2.1, 2025.1.3.5
• 2025.0.0.1, 2025.0.1.1, 2025.0.2.1, 2025.0.3.2
• 2024.2.0.1, 2024.2.1.1, 2024.2.2.1, 2024.2.3.1, 2024.2.4.1, 2024.2.5.2

FME Flow versions: 

• 2026.2
• 2026.1.2.1
• 2025.2.4.2
• 2025.1.3.5
• 2025.0.3.2
• 2024.2.5.2
• FME Flow instances with the hotfix patch and upgraded engine installed per the resolution option for backported security fixes described in the FME November 2026 Security Updates:
  • 2026.1.0.0 through 2026.1.2.0
  • 2025.2.0.0 through 2025.2.4.1
  • 2025.1.0.0 through 2025.1.3.4
  • 2025.0.0.0 through 2025.0.3.1
  • 2024.2.0.0 through 2024.2.5.1

Workaround

Use PythonCaller

Use Python to fetch the environment variable using a PythonCaller instead:

import fme
from fme import BaseTransformer
import fmeobjects
import os


class FeatureProcessor(BaseTransformer):
  def _init_(self):
    pass

  def has_support_for(self, support_type: int):
    return support_type == fmeobjects.FME_SUPPORT_FEATURE_TABLE_SHIM

  def input(self, feature: fmeobjects.FMEFeature):
    val = os.environ.get('YOUR_VAR_NAME', '')
    feature.setAttribute('_envvar', val)
    self.pyoutput(feature, output_tag="PYOUTPUT")

  def close(self):
    pass

  def process_group(self):
    pass

  def reject_feature(self, feature: fmeobjects.FMEFeature, code: str, message: str):
    feature.setAttribute("fme_rejection_code", code)
    feature.setAttribute("fme_rejection_message", message)
    self.pyoutput(feature, output_tag="<Rejected>")

Expose the newly created attribute (eg. ‘_envvar’) using the PythonCaller’s Attributes to Expose parameter so downstream transformers can access the attribute.

Apply Security Override

Alternatively, apply the following security override according to the instructions detailed in the article Security Hardening in FME 2026.2: 

{
  "security": {
    "tcl_interpreter": {
      "additional_unsafe_interpreters": ["CmdTcl2"]
    }
  },
  "version": 1
}

FME Flow Hosted users running an FME Flow version prior to 2026.2 are invited to contact Support for assistance with applying overrides, as there is no mechanism for FME Flow Hosted users to independently apply overrides.

Change the Security Tier

Alternatively, changing the security tier to the Minimal Hardening tier will allow Version 0 of the EnvironmentVariableFetcher to work again. 

Minimal Hardening is not recommended for most users.

Resolution

This issue is resolved in FME 2026.3 and later. This version ships a new version (1) of the EnvironmentVariableFetcher transformer, reimplemented natively (not using TCL), so it reads the environment directly and works under the Default Hardening tier and Full Hardening tiers, no minimal-tier switch or override needed.

If you choose to apply the security override or change the security tier in a prior version, we strongly advise you to restore your security configuration after upgrading to FME 2026.3+. You can do this by reversing the override or switching the security tier back to Default Hardening.