CVE-2026-64652

LOW 3.3

GitHub CLI: Partial token disclosure in `gh auth status` output

CVSS Score

3.3

EPSS Score

0.0%

EPSS Percentile

0th

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_<APPID>_<JWT>), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.

CWE	CWE-201
Vendor	cli
Product	cli
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for cli cli

Be the first to know when new low vulnerabilities affecting cli cli are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

cli / cli

< 2.97.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm github.com: https://github.com/cli/cli/commit/3f6a16a9f8c7fe9676aa8d8f47b399310dd231c3 github.com: https://github.com/cli/cli/releases/tag/v2.97.0