Authentication Token Exposure in GitHub CLI Before Version 2.97.0

CVE-2026-64652

What is CVE-2026-64652?

The GitHub CLI, the official command line tool for GitHub, has a vulnerability whereby fine-grained personal access tokens and GitHub App tokens were inadequately masked by the gh auth status command in versions prior to 2.97.0. This issue arises when the command is executed without the --show-token flag, revealing sensitive portions of access tokens in terminal or CI outputs, which could be inadvertently shared. This flaw particularly affects tokens formatted with an underscore following the prefix, potentially leading to unauthorized access if exposed. Users are encouraged to update to version 2.97.0 or later to mitigate this risk.

References