Docker Compose Security Linter Vulnerability in Compose-Lint by Tmatens
CVE-2026-123796

2.3LOW

Key Information:

Vendor

Tmatens

Status
Compose-lint
Vendor
CVE Published:
9 November 2026

What is CVE-2026-123796?

The vulnerability in Compose-Lint affects versions 0.32.0 to 0.33.0, where inadequate remediation of .env secret disclosure allows for potential exposure of sensitive data. When configured to check a considerable number of findings, the tool may emit graded findings that contain resolved secret values within various output formats. Exploitation necessitates a specific workflow where secrets are written into a sibling .env file and untrusted changes are linted, bypassing safeguard mechanisms unless certain options are applied during execution. The issue is resolved in version 0.33.0.

Affected Version(s)

compose-lint >= 0.32.0, < 0.33.0

References

https://github.com/tmatens/compose-lint/security/advisori...
x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/978
x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/31ec460399...
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.