CVE-2026-64652 cli CVE debrief

Who should care

Authenticated users of GitHub CLI, especially those using fine-grained personal access tokens or GitHub App tokens, should assess their exposure and update to version 2.97.0 or later.

Why it matters

CVE-2026-64652 is a low-severity vulnerability in GitHub CLI that could expose sensitive token information. Authenticated users should verify their token configurations and update to version 2.97.0 or later to mitigate the issue.

• Potential exposure of sensitive token information in terminal or CI output
• Need to verify token configurations and update to version 2.97.0 or later
• Review and update access controls for GitHub CLI usage

Technical summary

GitHub CLI (gh) prior to version 2.97.0 had a vulnerability where part of certain fine-grained personal access tokens and GitHub App tokens could appear in terminal or CI output when running the gh auth status command. This issue affected fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*). The vulnerability is fixed in version 2.97.0.

Defensive priority

Authenticated users of GitHub CLI should verify their token configurations and update to version 2.97.0 or later

Recommended defensive actions

• Update GitHub CLI to version 2.97.0 or later
• Verify token configurations for authenticated users
• Review and update access controls for GitHub CLI usage
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the affected GitHub CLI versions and token types. The issue is fixed in version 2.97.0. Evidence from the CVE record indicates that the vulnerability could expose sensitive token information in terminal or CI output. The CVE record was published on 2026-08-06T22:18:13.087Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.