Log in Start free

Vulnerability · Published Aug 6, 2026 · Assigned by GitHub_M

CVE-2026-64652GitHub CLI: Partial token disclosure in `gh auth status` output

Low 3.3

In plain English

A low-severity security flaw in cli from cli. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 95.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_<APPID>_<JWT>), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ghno fix listedDEBIAN-CVE-2026-64652
Debian:13ghno fix listedDEBIAN-CVE-2026-64652
Gogithub.com/cli/clino fix listedGO-2026-6766
Gogithub.com/cli/cli/v22.97.0GO-2026-6766
Gogithub.com/cli/cli/v22.97.0GHSA-cg6r-mpgc-h9mm
Ubuntu:22.04:LTSghno fix listedUBUNTU-CVE-2026-64652
Ubuntu:26.10ghno fix listedUBUNTU-CVE-2026-64652

Affected products (as reported)

VendorProductVersions
cli cli < 2.97.0

Weakness: CWE-201 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References