CVE-2026-123368
Received Received - Intake

Information Disclosure in compose-lint via Symbolic Link Handling

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: GitHub, Inc.

Description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123368
EUVD
EUVD-2026-120123

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tmatens compose-lint From 0.22.0 (inc) to 0.30.0 (inc)
tmatens compose-lint 0.31.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects compose-lint, a Docker Compose security linter, between versions 0.22.0 and 0.31.0. It allows the linter to follow symbolic links to .env files outside the project directory, potentially reading sensitive environment variables like those in /proc/self/environ. These variables could then appear in logs, JSON, SARIF reports, or Code Scanning alerts, though the linter's pass/fail result remains unchanged.

Detection Guidance

To detect this vulnerability, check if you are using compose-lint versions between 0.22.0 and 0.30.0. Run 'compose-lint --version' to verify the version. If the version is within this range, the system is vulnerable. Additionally, inspect Docker Compose projects for symlinked .env files pointing outside the project directory.

Commands to check for symlinks: 'find /path/to/project -type l -name .env' and 'ls -la /path/to/project/.env'. If symlinks exist, they may indicate exposure to this vulnerability.

Impact Analysis

If you use compose-lint in environments processing untrusted changes (e.g., CI/CD with fork pull requests), an attacker could create a symlink to expose your linter's environment variables. These secrets might leak in logs or reports, though GitHub typically withholds secrets from fork PRs. The impact is higher if JSON/SARIF outputs are exposed.

Mitigation Strategies

Upgrade compose-lint to version 0.31.0 or later immediately. Use the command 'pip install --upgrade compose-lint' or update your Docker image to the patched version.

Avoid using untrusted pull requests with secrets in CI/CD environments. Use the '--no-env' flag to disable environment variable reading if not required.

Review and remove any symlinked .env files in your projects. Ensure all .env files are within the project directory and not pointing to external paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123368. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...