Command Line Tool Vulnerability in GitHub CLI Affecting Authorization Handling
CVE-2026-48501

7.4HIGH

Key Information:

Vendor

Cli

Status
Cli
Vendor
CVE Published:
29 May 2026

What is CVE-2026-48501?

GitHub CLI, the official command line tool from GitHub, contained a vulnerability prior to version 2.93.0 that inadvertently included sensitive authorization headers in API requests directed to TUF repository mirrors. This occurred during the execution of commands such as gh attestation, gh release verify, and gh release verify-asset. A flawed host normalization process led to misattributed requests, where any request to a *.github.com subdomain—like tuf-repo.github.com—was incorrectly treated as a request to github.com. As a result, the tool sent user tokens intended only for github.com to unauthorized hosts, potentially exposing sensitive credentials. This vulnerability has been addressed in version 2.93.0.

Affected Version(s)

cli < 2.93.0

References

https://github.com/cli/cli/security/advisories/GHSA-8xvp-...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.