CVE-2026-123372
Received Received - Intake

Information Disclosure in compose-lint via .env File Exposure

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: GitHub, Inc.

Description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123372
EUVD
EUVD-2026-120129

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tmatens compose-lint From 0.22.0 (inc) to 0.31.0 (inc)
tmatens compose-lint 0.32.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

compose-lint is a Docker Compose security linter that checks for dangerous misconfigurations. Between versions 0.22.0 and 0.32.0, it substitutes values from a sibling .env file into image fields and includes those values in log messages and fix texts. This can expose secrets if an attacker manipulates a workflow to reference a secret variable.

Detection Guidance

Check if compose-lint versions between 0.22.0 and 0.32.0 are in use. Review logs for CL-0004 and CL-0019 findings that may expose secrets. Inspect .env files for sensitive data leaks in job logs or artifacts.

Impact Analysis

If you use compose-lint in a workflow that writes secrets to a .env file and then lints untrusted pull requests, an attacker could expose those secrets in job logs, JSON output, SARIF artifacts, or Code Scanning alerts. This requires a secret-bearing workflow like pull_request_target or a retained .env file.

Compliance Impact

This vulnerability could lead to unintended exposure of sensitive data in logs, JSON outputs, or SARIF reports during CI/CD processes. For GDPR, this may violate principles of data minimization and security, potentially resulting in unauthorized disclosure of personal data. Under HIPAA, it risks exposing protected health information if secrets like database passwords are logged, violating safeguards for electronic protected health information.

Mitigation Strategies

Upgrade compose-lint to version 0.32.0 or later. Remove secrets from .env files used in pull request workflows. Avoid using pull_request_target or same-repository branches with secret-bearing workflows.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123372. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...