CVE-2026-64652: GitHub CLI Authentication Token Exposure in `gh auth status` Output
Summary
CVE-2026-64652: GitHub CLI partially discloses authentication tokens in gh auth status output. Affects github.com/cli/cli/v2 versions < 2.97.0. Fixed in 2.97.0. How to fix ↓
Also tracked for
- github.com/cli/cli · Go
The same CVE-2026-64652 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitHub CLI is a command-line tool that allows users to interact with GitHub from the terminal. It provides functionalities such as managing repositories, issues, pull requests, and more. The tool is widely used by developers for its efficiency and integration with GitHub services. However, a vulnerability has been identified in the way it handles authentication tokens, specifically when users run the gh auth status command.
Vulnerability Detail
The vulnerability arises from the improper masking of authentication tokens in the output of the gh auth status command. When this command is executed without the --show-token flag, it may reveal a portion of the authentication token in plaintext. This issue affects fine-grained personal access tokens and GitHub App installation/user access tokens, which can lead to the exposure of sensitive information if the output is logged or shared. The vulnerability is particularly concerning in CI/CD environments where logs may be captured and stored.
How To Fix
Latest published version: v2.103.0 as of 23 Oct 2026
go get github.com/cli/cli/v2@v2.103.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.97.0
This is the first release that contains the fix.
go get github.com/cli/cli/v2@v2.97.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Until the upgrade is completed, users should avoid running the gh auth status command in contexts where the output may be captured or shared. If the command must be run, ensure to manually redact the token line before sharing any output.
Conclusion
The vulnerability identified as CVE-2026-64652 in GitHub CLI poses a risk of exposing authentication tokens through the gh auth status command. Users are advised to upgrade to version 2.97.0 to mitigate this risk and should take immediate action to rotate any potentially exposed tokens.
See every vulnerability recorded for github.com/cli/cli/v2 →
FAQ
The vulnerability affects fine-grained personal access tokens (e.g., github_pat_*) and GitHub App installation/user access tokens (e.g., ghs_*, ghu_*). Classic tokens like gho_* and ghp_* are not affected.
If you suspect that your token has been exposed, you should rotate the affected token immediately. For fine-grained personal access tokens, regenerate the token from your account settings.
In CI/CD environments, the output of gh auth status can be logged or shared, potentially exposing sensitive token information. This could lead to unauthorized access if the token is captured.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 3.3, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cli/cli/v2.
