CVE-2026-64652— GitHub CLI gh auth status 输出部分令牌泄露
可能的 ATT&CK 技术 1AI
T1530 · Data from Cloud Storage获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-64652 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
GitHub CLI: Partial token disclosure in `gh auth status` output
来源: CVE Program / CVE List V5
Vulnerability Description
GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_<APPID>_<JWT>), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
通过发送数据的信息暴露
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-64652 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-64652 的情报信息
请登录查看更多情报信息。
CVE-2026-64652 补丁与修复 (1)
CVE-2026-64652 厂商安全公告 (1)
CVE-2026-64652 厂商页面 (1)
同批安全公告 · cli · 2026-08-06 · 共 4 条
| CVE-2026-64654 | 5.3 MEDIUM | GitHub CLI 多个命令终端转义序列注入漏洞 |
| CVE-2026-64653 | 5.1 MEDIUM | GitHub CLI 请求URL未转义变量导致路径遍历 |
| CVE-2026-64655 | 2.1 LOW | GitHub CLI 证书签名请求验证绕过漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-64652
暂无评论