Environment variable expansion (${VAR}) in user parameters in FME 2026.3.1 and later

Consideration 

As of FME 2026.3.1 and FME 2026.4, environment variable expansion using the ${VAR} syntax in user parameters and other mapping file values is no longer permitted under the Default Hardening and Full Hardening tiers. Where a workspace uses this syntax, the translation stops before it runs and produces this message:

The translation stops whether or not the variable is defined on the host, and the message names the variable from the reference.

Why This Happens

Starting with version 2026.3.1, this feature was retired in favor of the EnvironmentVariableFetcher transformer, which offers a more secure alternative and should be used instead.

This applies to:

FME Form versions:

• 2026.4
• 2026.3.1

FME Flow versions: 

• 2026.4
• 2026.3.1

How to Resolve It

Use EnvironmentVariableFetcher

We recommend replacing ${VAR} references in parameter values with the EnvironmentVariableFetcher transformer. Expose the resulting attribute so that downstream transformers can access it.

Apply Security Override

Alternatively, users can apply the following security override according to the instructions detailed in the article Security Hardening in FME 2026.2:

{
    "version": 1,
    "security": {
        "mapping_file": {
            "additional_allowed_env_variables": [
                "MY_ENV_VAR_NAME"
            ]
        }
    }
}

FME Flow Hosted users running an FME Flow version prior to 2026.2 are invited to contact Support for assistance with applying overrides, as there is no mechanism for FME Flow Hosted users to independently apply overrides. 

Change the Security Tier

Alternatively, changing the security tier to the Minimal Hardening tier will allow ${VAR} expansion to work again. 

Minimal Hardening is not recommended for most users.