Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-64652 EUVD-2026-54212GHSA-cg6r-mpgc-h9mmGO-2026-6766

GitHub CLI: Partial token disclosure in `gh auth status` output

Published Aug 6, 2026 · Updated Aug 7, 2026 · Assigned by GitHub_M

Description

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_<APPID>_<JWT>), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.

Affected products

VendorProductAffectedFixed
cli cli < 2.97.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 gh No fix yet —
Debian 12 gh No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 gh No fix yet —
Ubuntu 22.04 LTS gh No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS gh No fix yet —
Ubuntu Pro 24.04 LTS gh No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed gh 2.97.0-1.1 openSUSE-SU-2026:11530-1
openSUSE Leap 16.0 gh 2.98.0-bp160.1.1 openSUSE-SU-2026:21663-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 gh 2.97.0-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/cli/cli all versions — GO-2026-6766
Go github.com/cli/cli/v2 < 2.97.0 2.97.0 GHSA-cg6r-mpgc-h9mm

Advisories 2

References