CVE-2026-72924

Received Received - Intake

Port Forwarding Exposure in GitHub CLI

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description

GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the user's non-loopback local IP addresses by other hosts that can route to the user's machine. This behavior does not change the GitHub-side visibility of the Codespaces port. Instead, it exposes the forwarded service through a wildcard-bound listener on the user's local machine, even when the source Codespaces port remains private. Exploitation requires a network-adjacent attacker to reach the victim's machine while forwarding is active. This issue is fixed in version 2.98.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-25

Generated

2026-08-26

AI Q&A

2026-08-26

EPSS Evaluated

N/A

NVD

CVE-2026-72924

Affected Vendors & Products

Vendor	Product	Version / Range
github	github_cli	From 2.28.0 (inc) to 2.97.0 (inc)
github	github_cli	2.98.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CWE-1327	The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

Attack-Flow Graph

Executive Summary

GitHub CLI versions 2.28.0 through 2.97.0 have a flaw where the local listener for port forwarding binds to all network interfaces by default. This exposes forwarded services from Codespaces to other hosts on the local network via the user's non-loopback IP addresses, even if the Codespaces port remains private.

Detection Guidance

Check if GitHub CLI version is between 2.28.0 and 2.97.0. Run 'gh version' to verify. Inspect active port forwarding with 'netstat -tuln' or 'ss -tuln' to see if ports are bound to all interfaces (0.0.0.0). Look for unexpected services exposed on non-loopback addresses.

Impact Analysis

An attacker on the same network could access services running in your Codespace through your local machine's IP address while port forwarding is active. This requires the attacker to be network-adjacent and the forwarding to be enabled.

Mitigation Strategies

Upgrade GitHub CLI to version 2.98.0 or later immediately. Avoid using port forwarding in untrusted networks. Restrict network access to your machine if forwarding is necessary. Monitor for unauthorized access to forwarded ports.

Hi! I’m here to help you understand CVE-2026-72924. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70