CVE-2026-64652

Received Received - Intake

GitHub CLI Token Exposure in Auth Status Output

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_<APPID>_<JWT>), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-64652

Affected Vendors & Products

Vendor	Product	Version / Range
github	gh	2.97.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

GitHub CLI (gh) versions before 2.97.0 masked only characters after the last underscore in certain tokens during 'gh auth status' output. This could expose part of fine-grained personal access tokens or GitHub App tokens in terminal or CI logs if captured or shared.

Detection Guidance

Check the version of GitHub CLI installed on your system using 'gh --version'. If it is below 2.97.0, the system is vulnerable. Review terminal or CI logs for any exposed tokens after an underscore in fine-grained personal access tokens or GitHub App tokens.

Impact Analysis

If you used 'gh auth status' with affected tokens (github_pat_*, ghs_*, ghu_*, or GITHUB_TOKEN) before version 2.97.0, part of the token may have been visible in logs or shared output. This could lead to partial token exposure and potential misuse if captured by unauthorized parties.

Compliance Impact

This vulnerability could result in unauthorized exposure of sensitive authentication tokens, potentially violating data protection requirements under GDPR or HIPAA if tokens grant access to regulated data. Organizations should ensure tokens are not exposed in logs to maintain compliance.

Mitigation Strategies

Upgrade GitHub CLI to version 2.97.0 or later using your package manager. Rotate any exposed tokens immediately, especially fine-grained personal access tokens or GitHub App tokens containing underscores.

Hi! I’m here to help you understand CVE-2026-64652. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70