Insertion of Sensitive Information Into Sent Data in GitHub CLI - CVE-2026-64652
Published: July 31, 2026
Vulnerability identifier: #VU140580
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64652
CWE-ID: CWE-201
Exploitation vector: Local access
Exploit availability:
No public exploit available
Affected software:
GitHub CLI
GitHub CLI
Detailed vulnerability description
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into sent data in the `gh auth status` output masking logic when reporting authentication state. A local user can run `gh auth status` and capture or share the output to disclose sensitive information.
Only token formats containing an underscore after the prefix are affected, and the issue occurs when the command is run without the `--show-token` flag.
How to mitigate CVE-2026-64652
Install security update from vendor's website.