ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-64652

GitHub CLI partially discloses authentication tokens in output

Published Oct 15, 2026 · catalog updated Oct 15, 2026 · GitHub CLI partially discloses

Check if you run it

No confirmed exploitation is on record for CVE-2026-64652. EPSS is 0.15%. Act only if a listed version of GitHub CLI partially discloses is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (GitHub CLI partially discloses).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low3.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.15%
Remediation
Version ranges on file
Affected products
Go github.com/cli/cli/v2 · go github.com/cli/cli/v2 · golang github.com

### Summary A security vulnerability has been identified in GitHub CLI where could potentially print a portion of the authentication token in plaintext, depending on the lexical structure of the token. Affected users: - Authenticated users who ran (without the flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens ( ) and GitHub App installation/user access tokens ( , , e.g., ), including the Actions . Classic tokens such as and have an underscore-free body and are not affected. ### Details The vulnerability stems from the way GitHub CLI masks the authentication token when reporting authentication state: 1. A user runs without , expecting the token to be fully masked. 2. The masking logic redacts only the characters that follow the last underscore in the token, instead of redacting everything after the token prefix. 3. The partially masked token is written to the command output, where it can be captured or shared. Because is a diagnostic command commonly run interactively and inside automated environments, the leaked token characters can end up in CI/CD job logs, terminal scrollback, screen recordings, screenshots, or pasted output shared in bug reports and support requests. In , GitHub CLI fully masks the token in output, preserving only the known token prefix and redacting the remainder unless is explicitly provided. ### Impact Running in a context where the output is captured, logged, or shared could leak a portion of an affected token. The affected token types are fine-grained personal access tokens ( ) and GitHub App installation/user access tokens ( , , e.g., ), including the Actions . Installation and Actions tokens are short-lived, which narrows the window in which a recovered token could be reused. See [GitHub credential types](https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/github-credential-types#credential-types-overview). ### Remediation a

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/cli/cli/v20 → 2.97.0
  • go github.com/cli/cli/v2< 2.97.0
  • golang github.comversion unspecified

How to fix CVE-2026-64652

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-64652. EPSS is 0.15%. Act only if a listed version of GitHub CLI partially discloses is installed.

Which versions are affected?

Compare what you have installed with 0 → 2.97.0, < 2.97.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-201. EPSS 0.15%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · GitHub Advisory Database

    Detected

    ### Summary A security vulnerability has been identified in GitHub CLI where could potentially print a portion of the authentication token in plaintext, depending on the lexical structure of the token. Affected users: - Authenticated users who ran (without the flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens ( ) and Git

  2. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/cli/cli/v2 fixed in 2.97.0

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/cli/cli/v2 fixed in 2.97.0

  4. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary A security vulnerability has been identified in GitHub CLI where could potentially print a portion of the authentication token in plaintext, depending on the lexical structure of the token. Affected users: - Authenticated users who ran (without the flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens ( ) and Git

Sources

  • CVE.orgVulnerability recordCVE-2026-64652

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-64652

    30-day exploitation probability 0.2%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-cg6r-mpgc-h9mm

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-64652

    A security vulnerability has been identified in GitHub CLI where gh auth status could potentially print a portion of the authentication token in plaintext, depending on the lexical structure of the token. Affected users: Authenticated users who ran gh auth status (without the &ndash;show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-cg6r-mpgc-h9mm

    GitHub CLI partially discloses authentication tokens in output

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.