Local Permission Assignment Flaw in Gitleaks Affects Sensitive Data Exposure

CVE-2026-124039

What is CVE-2026-124039?

Gitleaks versions prior to 8.30.1 exhibit an incorrect permission assignment vulnerability, presenting a risk where local users can access sensitive scan reports. The issue arises due to the way the --report-path file is created using os.Create with default permissions. If the --redact option is not utilized, this allows other local users on shared hosts or CI runners to access plaintext secrets and associated data, potentially leading to unauthorized credential exposure. Users are advised to review their configuration and ensure that appropriate options are in place to mitigate this risk.

References