{"id":"EUVD-2026-54212","enisaUuid":"f50b736f-c6bc-3c01-adb2-6fa81b3a67c7","description":"GitHub CLI (gh) is GitHub\u0027s official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_\u003cAPPID\u003e_\u003cJWT\u003e), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.","datePublished":"Aug 6, 2026, 5:45:35 PM","dateUpdated":"Aug 7, 2026, 5:45:03 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm\nhttps://github.com/cli/cli/commit/3f6a16a9f8c7fe9676aa8d8f47b399310dd231c3\nhttps://github.com/cli/cli/releases/tag/v2.97.0\n","aliases":"CVE-2026-64652\nGHSA-cg6r-mpgc-h9mm\n","assigner":"GitHub_M","epss":0.16,"enisaIdProduct":[{"id":"1fe81d4d-10bc-3440-aa22-3498fcde65b9","product":{"name":"cli","vendor":{"name":"cli"}},"product_version":"\u003c 2.97.0"}],"enisaIdVendor":[{"id":"c8fdf989-ec3f-308c-9eac-80b78f630ff8","vendor":{"name":"cli"}}],"enisaIdVulnerability":[{"id":"25bcd3e0-1d03-3d1e-b457-712b70b5a341","vulnerability":{"id":"GHSA-cg6r-mpgc-h9mm","description":"GitHub CLI partially discloses authentication tokens in `gh auth status` output","datePublished":"Oct 15, 2026, 6:05:19 PM","dateUpdated":"Oct 15, 2026, 6:05:20 PM","baseScore":0.0,"references":"https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64652\nhttps://github.com/cli/cli/commit/3f6a16a9f8c7fe9676aa8d8f47b399310dd231c3\nhttps://github.com/cli/cli\nhttps://github.com/cli/cli/releases/tag/v2.97.0\n","enisa_id":"EUVD-2026-54212\n","aliases":"CVE-2026-64652\nGHSA-cg6r-mpgc-h9mm\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e170a53d-0f9b-3cc7-8c29-3e566887fcc9","vulnerability":{"id":"CVE-2026-64652","description":"GitHub CLI (gh) is GitHub\u0027s official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_\u003cAPPID\u003e_\u003cJWT\u003e), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.","datePublished":"Aug 6, 2026, 5:45:35 PM","dateUpdated":"Aug 7, 2026, 5:45:03 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm\nhttps://github.com/cli/cli/commit/3f6a16a9f8c7fe9676aa8d8f47b399310dd231c3\nhttps://github.com/cli/cli/releases/tag/v2.97.0\n","enisa_id":"EUVD-2026-54212\n","assigner":"GitHub_M","epss":0.16,"dataProcessed":"Oct 30, 2026, 7:15:41 AM","vulnerabilityProduct":[{"id":"a2c6db23-9f22-3f4b-b5a9-a910c50e0b4e","product":{"name":"cli","vendor":{"name":"cli"}},"product_version":"\u003c 2.97.0"}],"vulnerabilityVendor":[{"id":"890d824e-1024-3438-bf4f-5ffdc018e77d","vendor":{"name":"cli"}}]}}],"enisaIdAdvisory":[{"id":"7a8d75c3-8feb-301b-9595-8873030fdb46","advisory":{"id":"openSUSE-SU-2026:21663-1","description":"Security update for gh","summary":"Security update for gh","datePublished":"Aug 26, 2026, 4:15:07 PM","dateUpdated":"Sep 17, 2026, 5:42:37 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21663-1.json\nhttps://bugzilla.suse.com/1266618\nhttps://bugzilla.suse.com/1276661\nhttps://bugzilla.suse.com/1276662\nhttps://bugzilla.suse.com/1276663\nhttps://bugzilla.suse.com/1276664\nhttps://www.suse.com/security/cve/CVE-2026-39821/\nhttps://www.suse.com/security/cve/CVE-2026-64652/\nhttps://www.suse.com/security/cve/CVE-2026-64653/\nhttps://www.suse.com/security/cve/CVE-2026-64654/\nhttps://www.suse.com/security/cve/CVE-2026-64655/\n","aliases":"CVE-2026-39821\nCVE-2026-64652\nCVE-2026-64653\nCVE-2026-64654\nCVE-2026-64655\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0a3324d2-cd24-33d3-9513-5c6b2a307054","product":{"name":"gh-bash-completion-0:2.98.0-bp160.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"1dee3c84-204f-3d47-9452-8c09f515f66a","product":{"name":"gh-fish-completion-0:2.98.0-bp160.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"27da8119-d16a-3860-bbc3-1fe563ca7f48","product":{"name":"gh-0:2.98.0-bp160.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"3f7332f1-f44a-3596-bd5e-75cac50510d6","product":{"name":"gh-0:2.98.0-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"726f83ed-682b-35ed-90d5-a145dda9e535","product":{"name":"gh-zsh-completion-0:2.98.0-bp160.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"802a8b47-750a-3e55-a3f5-b562f22ce757","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"d35cb0a2-935b-33b2-8085-cea381699246","product":{"name":"gh-0:2.98.0-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"fd3bef13-01da-3dcc-9a1c-1194658d0526","product":{"name":"gh-0:2.98.0-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"8c84dafc-9eab-3a3f-9c48-da061a1a4d47","advisory":{"id":"openSUSE-SU-2026:11530-1","description":"gh-2.97.0-1.1 on GA media","summary":"gh-2.97.0-1.1 on GA media","datePublished":"Aug 17, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:19:55 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11530-1.json\nhttps://www.suse.com/security/cve/CVE-2026-64652/\nhttps://www.suse.com/security/cve/CVE-2026-64653/\nhttps://www.suse.com/security/cve/CVE-2026-64654/\nhttps://www.suse.com/security/cve/CVE-2026-64655/\n","aliases":"CVE-2026-64652\nCVE-2026-64653\nCVE-2026-64654\nCVE-2026-64655\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"05081f45-6c93-3175-b06d-c0fd84ab2303","product":{"name":"gh-zsh-completion-0:2.97.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"11ad0a39-ef69-3433-815c-841d589375e2","product":{"name":"gh-fish-completion-0:2.97.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"257cce34-e582-3ce6-9b79-3dc2d99690c7","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"2601d2a6-804f-3a93-ad29-5129458f0932","product":{"name":"gh-fish-completion-0:2.97.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"2fe30d22-756e-30e7-866b-580542648347","product":{"name":"gh-zsh-completion-0:2.97.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"4548076c-5f54-35bf-bf6d-f5057b8f29c0","product":{"name":"gh-bash-completion-0:2.97.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"59c96c25-3324-30b7-8cbf-2419a2f53a2b","product":{"name":"gh-bash-completion-0:2.97.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6c45aaea-b025-337d-9dd7-63622d539cdf","product":{"name":"gh-fish-completion-0:2.97.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6dda8d88-67d9-3063-be1c-a37f0abbbdde","product":{"name":"gh-0:2.97.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"713eac1d-ba87-3fa6-a393-60f10bd4fd44","product":{"name":"gh-0:2.97.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"74253eff-db36-3fad-a1b6-eab2ec5c53fc","product":{"name":"gh-fish-completion-0:2.97.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"854261ae-c52b-3b68-924a-e642a3d77bce","product":{"name":"gh-bash-completion-0:2.97.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"adbd65af-980f-354e-887b-762b9f923e94","product":{"name":"gh-0:2.97.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b5aabe9e-bc63-3b20-aad2-7a71e44501f8","product":{"name":"gh-bash-completion-0:2.97.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c35dd7cd-804a-32cb-bc26-5c3bcc7a80ae","product":{"name":"gh-zsh-completion-0:2.97.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d58410a8-b2f3-36e4-bf33-fe2cc866f8f0","product":{"name":"gh-0:2.97.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"fee80ac9-97ec-357d-93e1-af2c18c0cf25","product":{"name":"gh-zsh-completion-0:2.97.0-1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"f438b957-e270-359e-bd8f-c2e106ed2d2a","advisory":{"id":"msrc_CVE-2026-64652","description":"GitHub CLI: Partial token disclosure in `gh auth status` output","datePublished":"Aug 11, 2026, 1:02:48 AM","dateUpdated":"Aug 23, 2026, 2:50:42 PM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64652.json\n","aliases":"CVE-2026-64652\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"20ac022f-169c-3102-9be8-6eeeb67c4687","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"3319b895-b988-3b69-a602-25cf94125f2b","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"455e4361-f547-37de-9658-7c0e1ed12203","product":{"name":"gh","vendor":{"name":"r-lib"}}},{"id":"5c7a4bac-53f5-39a3-b8a9-b63315b814df","product":{"name":"azl3 gh 0:2.62.0-20.azl3","vendor":{"name":"Microsoft"}}}]}}]}