Docker Compose Security Linter Vulnerability in Compose-lint by TMatens

CVE-2026-123372

What is CVE-2026-123372?

The Compose-lint tool, a security linter for Docker Compose files, has a vulnerability that allows dangerous misconfigurations to potentially expose sensitive secrets. When using versions 0.22.0 to 0.32.0 of the tool, it improperly substitutes values from a sibling .env file into image fields. If an untrusted pull request references a secret variable, the full value can inadvertently appear in job logs, JSON output, SARIF artifacts, and Code Scanning alerts. This risk is especially pronounced in workflows that utilize specific triggers such as pull_request_target or houses secrets on a self-hosted runner. The issue has been resolved in version 0.32.0.

References