3.3

CVE-2026-64652: cli

CVSS: 3.3v3.1LowAwaiting analysis
AliasesUBUNTU-CVE-2026-64652DEBIAN-CVE-2026-64652GHSA-cg6r-mpgc-h9mm
Published 06-08-2026Last modified 07-08-2026
Open JSON

Vulnerability summary

CVE-2026-64652 is a low (CVSS 3.3) vulnerability in cli. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.2% of scored vulnerabilities.

Overall risk
13/100
0100
Low · default modelHow is this calculated?
CVSS score
3.3/10
010
Low · v3.1 (CVE.org)
EPSS score
0.15%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2026:11530-1OPENSUSE-SU-2026:21663-1

Timeline

  1. 06-08-2026
    PublishedVulnerability first disclosed.
  2. 07-08-2026
    Last modifiedVulnerability information updated.

Description

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_<APPID>_<JWT>), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

+0.04 pp

From 0.12% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Cli1 product
Debian1 product
  • ghAll versions (No fix recorded)
Github.com/cli1 product
  • cliAll versions (No fix recorded)
Github.com/cli/cli1 product
  • v2< 2.97.0
Ubuntu1 product
  • ghAll versions (No fix recorded)

5 vendors · 5 products

References

8 links