CVE-2026-123796
Received Received - Intake

Secret Disclosure in Compose-Lint via .env Misconfiguration

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: GitHub, Inc.

Description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123796
EUVD
EUVD-2026-120157

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tmatens compose-lint From 0.32.0 (inc) to 0.33.0 (inc)
tmatens compose-lint 0.33.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in compose-lint (versions 0.32.0 to 0.33.0) involves incomplete remediation of .env secret disclosure checks. When a run exceeds 20,000 findings, secrets from a .env file are exposed in outputs like text, JSON, or SARIF because resolved values appear instead of variable references. The issue requires a workflow that writes secrets into .env and lints untrusted changes, triggering partial output with secrets.

Detection Guidance

To detect this vulnerability, check if you are using compose-lint versions between 0.32.0 and 0.33.0. Run 'compose-lint --version' to verify the installed version. If the version is within this range, inspect CI/CD logs for secret exposure in outputs like text, JSON, or SARIF when processing Docker Compose files with untrusted changes.

Impact Analysis

If exploited, this vulnerability could expose sensitive secrets in CI/CD outputs, even when GitHub masks logs. Attackers could craft pull requests to trigger the finding limit, causing secrets like database passwords to appear in plaintext in linting outputs. This risks unauthorized access to systems or data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing sensitive personal or health data in CI outputs. Unauthorized disclosure of secrets may violate confidentiality requirements, leading to legal penalties or reputational damage.

Mitigation Strategies

Upgrade compose-lint to version 0.33.0 or later immediately. Avoid writing secrets into .env files for untrusted workflows. Use the '--no-env' flag to disable environment file processing if possible. Review CI/CD logs for past secret exposure and rotate any exposed secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123796. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...