Improper Authorization in GitHub CLI - CVE-2026-48501
Published: May 28, 2026
Vulnerability identifier: #VU132663
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48501
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in the shared HTTP client authentication layer when handling requests to TUF repository mirrors and external artifact hosts. A remote attacker can cause the GitHub CLI to send authentication tokens in outbound requests to disclose sensitive information.
The issue affects `gh attestation`, `gh release verify`, and `gh release verify-asset` commands during their normal retrieval of TUF metadata and artifact bundles.
Affected software
GitHub CLI
How to mitigate CVE-2026-48501
Install security update from vendor's website.
GitHub CLI - update to 2.93.0