CVE-2026-64652 Details

A vulnerability in GitHub CLI prior to version 2.97.0 allows for partial disclosure of authentication tokens when the 'gh auth status' command is executed without the '--show-token' flag. This issue affects fine-grained personal access tokens and GitHub App tokens, as well as the Actions GITHUB_TOKEN. The vulnerability arises because the masking logic only obscures characters after the last underscore in the token, leaving part of the token visible in the output. This exposed information could be captured or shared, potentially leading to unauthorized access.

Users should upgrade GitHub CLI to version 2.97.0 or later. Additionally, any affected tokens that may have been exposed should be rotated. Fine-grained personal access tokens can be regenerated from GitHub account settings, while GitHub App tokens are short-lived and rotate automatically. The Actions GITHUB_TOKEN is also automatically invalidated at the end of a job, so no manual action is typically required.