CVE-2026-64652: low-severity vulnerability in cli
GitHub CLI: Partial token disclosure in `gh auth status` output
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.3epss 0.2%
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_<APPID>_<JWT>), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
cli · cliRelated CVEs — cli
In the same product, most dangerous first.
CVE-2024-52308HIGHConnecting to a malicious Codespaces via GH CLI could allow command execution on the user's computerEPSS 0.9%CVE-2026-64654MEDIUMGitHub CLI: Terminal escape sequence injection in multiple `gh` commandsEPSS 0.8%CVE-2024-54132MEDIUMGitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerabilityEPSS 0.6%CVE-2026-64653MEDIUMGitHub CLI: Unescaped variable components in request URLs could allow path traversalEPSS 0.5%CVE-2025-25204MEDIUM`gh attestation verify` returns incorrect exit code during verification if no attestations are presentEPSS 0.4%CVE-2026-64655LOWGitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN MatchingEPSS 0.3%