---
cve: "CVE-2026-64652"
severity: "LOW"
cvss: 3.3
epss: "0.1%"
vendor: "cli"
kev: false
exploited: false
published: "2026-08-06 22:18:13"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-21T13:18:55+02:00"
---

# CVE-2026-64652

> 3.3 LOW · 🧪 PoC

## Beschreibung

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs__), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Patch verfügbar (OSV)

- 3f6a16a9f8c7fe9676aa8d8f47b399310dd231c3 (Commit)
- 55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55 (Commit)

## Referenzen

- <https://github.com/cli/cli/security/advisories/GHSA-cg6r-mpgc-h9mm>
- <https://github.com/cli/cli/commit/3f6a16a9f8c7fe9676aa8d8f47b399310dd231c3>
- <https://github.com/cli/cli/releases/tag/v2.97.0>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-64652) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_