CVE-2026-64652 cli CVE debrief

Who should care

Authenticated users of GitHub CLI who have run gh auth status with affected token types should verify their token usage and update to version 2.97.0 or later. This includes users with fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*). Users should review their token types and ensure proper masking of sensitive information. Additionally, users with classic tokens such as gho_* and ghp_* are not affected by this vulnerability. Users should also be cautious when using the --show-token flag with gh auth status, as it may reveal sensitive information in terminal or CI output that is captured or shared. It is recommended that users review their token usage and update to version 2.97.0 or later to prevent potential exposure. Furthermore, users should verify their token types and ensure that they are not using affected tokens in their workflows. By taking these steps, users can help prevent potential security risks associated with this vulnerability. Users should also consider reviewing their token usage and verifying their token types to ensure that they are not exposing sensitive information. This can be done by reviewing the token usage and verifying the token types in use. Users should also ensure that they are using the latest version of the GitHub CLI to prevent potential security risks. By following these steps, users can help ensure the security of their GitHub CLI usage and prevent potential security risks associated with this vulnerability. The vulnerability's impact is relatively low, but users should still exercise caution and review their token usage. Users should also consider implementing additional security measures to prevent potential security risks associated with this vulnerability. This can include reviewing their token usage and verifying their token types to ensure that they are not exposing sensitive information. Users should also ensure that they are using the latest version of the GitHub CLI to prevent potential security risks. By taking these steps, users can help ensure the security of their GitHub CLI usage and prevent potential security risks associated with this The GitHub

Technical summary

The GitHub CLI (gh) had a vulnerability where it only masked characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. This could lead to parts of affected tokens being visible in terminal or CI output. The issue is fixed in version 2.97.0. Affected tokens include fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*). The vulnerability's impact is relatively low, but users should update to the latest version to prevent potential exposure.

Defensive priority

Authenticated users should verify their token types and update to version 2.97.0 or later to ensure proper masking of sensitive information.

Recommended defensive actions

• Update to version 2.97.0 or later
• Review token usage and verify token types
• Use --show-token flag with caution
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD entry provide information on the vulnerability and its fix in version 2.97.0 of the GitHub CLI. Authenticated users who ran gh auth status with affected token types should review their token usage, focusing on fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*). The issue's scope is limited to tokens with an underscore after the prefix. Users should verify their token types and update to version 2.97.0 or later to ensure proper masking of sensitive information. Evidence from the CVE record and NVD entry suggests that the vulnerability is not highly severe, with a CVSS score of 3.3. However, users should still exercise caution and review their token usage.

Official resources