CVE-2026-48501
GitHub CLI tokens leak via `gh attestation` commands
Description
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authentication layer that automatically attaches tokens to outgoing requests. This layer lacks accurate host detection and can incorrectly attribute the target host, providing it with a token it should never receive. Specifically, the host normalization logic collapses any *.github.com subdomain to github.com, so a request to tuf-repo.github.com (a GitHub Pages site, not a GitHub API endpoint) is treated as a request to github.com and receives the user's github.com token. For hosts that don't match github.com or a known GHES instance at all, the resolver falls back to GH_ENTERPRISE_TOKEN if set. The gh attestation, gh release verify and gh release verify-asset commands fetch data from several external hosts as part of their normal operation (TUF metadata from tuf-repo.github.com and tuf-repo-cdn.sigstore.dev, artifact bundles from Azure Blob Storage). Because these requests go through the same authenticated HTTP client, the token is sent to all of them. This vulnerability is fixed in 2.93.0.
INFO
Published Date :
May 29, 2026, 4:16 p.m.
Last Modified :
July 21, 2026, 3:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Update GitHub CLI to version 2.93.0 or later.
- Verify the updated CLI version is running.
- Review CLI configurations for security settings.
Public PoC/Exploit Available at Github
CVE-2026-48501 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48501.
| URL | Resource |
|---|---|
| https://github.com/cli/cli/security/advisories/GHSA-8xvp-7hj6-mcj9 | Mitigation Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48501 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48501
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
All Public RunWhen Helm Charts - Managed by terraform
Shell Dockerfile Go Template
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48501 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-48501 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 21, 2026
Action Type Old Value New Value Added Translation Title: GitHub CLI, Description: GitHub CLI (gh) es la herramienta oficial de línea de comandos de GitHub. Antes de la versión 2.93.0, GitHub CLI incluye incorrectamente el encabezado de autorización en las solicitudes de API a espejos de repositorio TUF a través de los comandos gh attestation, gh release verify y gh release verify-asset. La CLI utiliza un cliente HTTP compartido con una capa de autenticación que adjunta automáticamente tokens a las solicitudes salientes. Esta capa carece de detección precisa de host y puede atribuir incorrectamente el host de destino, proporcionándole un token que nunca debería recibir. Específicamente, la lógica de normalización de host colapsa cualquier subdominio *.github.com a github.com, por lo que una solicitud a tuf-repo.github.com (un sitio de GitHub Pages, no un punto final de API de GitHub) se trata como una solicitud a github.com y recibe el token github.com del usuario. Para hosts que no coinciden en absoluto con github.com o una instancia GHES conocida, el resolvedor recurre a GH_ENTERPRISE_TOKEN si está configurado. Los comandos gh attestation, gh release verify y gh release verify-asset obtienen datos de varios hosts externos como parte de su operación normal (metadatos TUF de tuf-repo.github.com y tuf-repo-cdn.sigstore.dev, paquetes de artefactos de Azure Blob Storage). Debido a que estas solicitudes pasan por el mismo cliente HTTP autenticado, el token se envía a todos ellos. Esta vulnerabilidad se corrige en la versión 2.93.0. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'cli', 'product': 'cli', 'versions': [{'status': 'affected', 'version': '< 2.93.0'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-48501', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-05-29T17:13:29.316659Z'} -
Initial Analysis by [email protected]
Jun. 03, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Added CPE Configuration OR *cpe:2.3:a:github:cli:*:*:*:*:*:*:*:* versions up to (excluding) 2.93.0 Added Reference Type GitHub, Inc.: https://github.com/cli/cli/security/advisories/GHSA-8xvp-7hj6-mcj9 Types: Mitigation, Vendor Advisory -
New CVE Received by [email protected]
May. 29, 2026
Action Type Old Value New Value Added Description GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authentication layer that automatically attaches tokens to outgoing requests. This layer lacks accurate host detection and can incorrectly attribute the target host, providing it with a token it should never receive. Specifically, the host normalization logic collapses any *.github.com subdomain to github.com, so a request to tuf-repo.github.com (a GitHub Pages site, not a GitHub API endpoint) is treated as a request to github.com and receives the user's github.com token. For hosts that don't match github.com or a known GHES instance at all, the resolver falls back to GH_ENTERPRISE_TOKEN if set. The gh attestation, gh release verify and gh release verify-asset commands fetch data from several external hosts as part of their normal operation (TUF metadata from tuf-repo.github.com and tuf-repo-cdn.sigstore.dev, artifact bundles from Azure Blob Storage). Because these requests go through the same authenticated HTTP client, the token is sent to all of them. This vulnerability is fixed in 2.93.0. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Added CWE CWE-863 Added Reference https://github.com/cli/cli/security/advisories/GHSA-8xvp-7hj6-mcj9