{"id":"CVE-2026-123371","kind":"vulnerability","aliases":["CVE-2026-123371"],"related":[],"title":"compose-lint: symlinked policy file leaks fragments of runner credentials","description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project and includes part of the target line when that external file fails YAML parsing. A pull request can point the policy file at a runner credential file, causing about 30 characters around an attacker-uncontrolled parse position to appear in standard error, JSON errors, and SARIF tool execution notifications uploaded by the GitHub Action. The run exits with an error and the attacker cannot select the exact disclosed line, but public logs or Code Scanning output can reveal part of the target. This issue is fixed in version 0.32.0.","summary":"compose-lint follows a .compose-lint.yml symbolic link to a file outside the project, and when that file fails YAML parsing it prints about 30 characters of its content into logs and SARIF output. A pull request can point the link at a runner credential file, so public CI logs or Code Scanning results may reveal part of that secret.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","compose-lint","docker-compose","github-actions","package"],"not_affected_if":["no-pull-request-triggers","private-repositories","version-0.32.0-or-later"],"how_to_check":"- Check the compose-lint version in the project or action config: `compose-lint --version` or the action version pinned in the workflow\n- Look at whether public workflows run compose-lint on pull requests from forks and upload SARIF to Code Scanning","fix":"- compose-lint: move to `0.32.0`","status":"open","published_at":"2026-11-09T18:17:26+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","triaged_at":"2026-11-09T18:29:26+00:00","updated_at":"2026-11-09T18:29:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T18:29:26Z","model":"claude-haiku-5-5","output":{"fix":"- compose-lint: move to `0.32.0`","reach":"internet","title":"compose-lint: symlinked policy file leaks fragments of runner credentials","impact":"low","summary":"compose-lint follows a .compose-lint.yml symbolic link to a file outside the project, and when that file fails YAML parsing it prints about 30 characters of its content into logs and SARIF output. A pull request can point the link at a runner credential file, so public CI logs or Code Scanning results may reveal part of that secret.","audience":"developers","category":"package","nicknames":[],"who_cares":["compose-lint","github-actions","docker-compose","ci"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"part of a CI runner credential file appears in public logs","analyst_note":"","how_to_check":"- Check the compose-lint version in the project or action config: `compose-lint --version` or the action version pinned in the workflow\n- Look at whether public workflows run compose-lint on pull requests from forks and upload SARIF to Code Scanning","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.32.0-or-later","no-pull-request-triggers","private-repositories"],"who_is_affected":"Teams that run the compose-lint GitHub Action or CLI on pull requests, especially on public repositories where logs and Code Scanning results are visible. Versions from 0.2.0 up to but not including 0.32.0 are exposed; the attacker cannot choose the exact line disclosed, only partial content of the target file appears.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000759,"input_tokens":4738,"output_tokens":571,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123371':14A,17A '-2026':13A,16A '0.2.0':105C '0.32.0':107C,212C '30':53B,152C 'action':27B,177C 'appear':162C 'around':154C 'attack':157C,186C 'attacker-uncontrol':156C 'automat':111C 'cannot':187C 'caus':150C 'charact':54B,153C 'ci':18B,77B 'code':80B,197C 'compos':2A,20B,24B,30B,90C,95C,109C 'compose-lint':1A,19B,29B,89C,108C 'compose-lint.yml':34B,114C 'content':57B 'credenti':11A,73B,148C 'cve':12A,15A 'danger':100C 'deploy':103C 'disclos':191C 'docker':23B,94C 'docker-compos':22B 'error':165C,167C,183C 'exact':190C 'execut':171C 'exit':180C 'extern':132C 'fail':47B,134C 'file':6A,39B,46B,74B,117C,133C,144C,149C 'fix':209C 'follow':32B,112C 'fragment':8A 'github':26B,176C 'github-act':25B 'identifi':99C 'includ':124C 'issu':207C 'json':166C 'leak':7A 'line':129C,192C 'link':36B,69B,119C 'lint':3A,21B,31B,91C,110C 'linter':97C 'log':59B,78B,195C 'may':83B 'misconfigur':101C 'notif':172C 'output':62B,199C 'outsid':40B,120C 'packag':28B 'pars':49B,136C,159C 'part':85B,125C,202C 'point':67B,141C 'polici':5A,116C,143C 'policy-fil':115C 'posit':160C 'print':51B 'project':42B,122C 'public':76B,194C 'pull':64B,138C 'request':65B,139C 'result':82B 'reveal':84B,201C 'run':179C 'runner':10A,72B,147C 'sarif':61B,169C 'scan':81B,198C 'secret':88B 'secur':96C 'select':188C 'standard':164C 'symbol':35B,118C 'symlink':4A 'target':128C,205C 'tool':170C 'uncontrol':158C 'upload':173C 'version':211C 'yaml':48B,135C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the compose-lint GitHub Action or CLI on pull requests, especially on public repositories where logs and Code Scanning results are visible. Versions from 0.2.0 up to but not including 0.32.0 are exposed; the attacker cannot choose the exact line disclosed, only partial content of the target file appears.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","composelint","dockercompose","githubactions","low","package"],"campaign_type":null,"search_a":"'-123371':14A,17A '-2026':13A,16A 'compos':2A 'compose-lint':1A 'credenti':11A 'cve':12A,15A 'file':6A 'fragment':8A 'leak':7A 'lint':3A 'polici':5A 'runner':10A 'symlink':4A","search_b":"'30':53B 'action':27B 'charact':54B 'ci':18B,77B 'code':80B 'compos':20B,24B,30B 'compose-lint':19B,29B 'compose-lint.yml':34B 'content':57B 'credenti':73B 'docker':23B 'docker-compos':22B 'fail':47B 'file':39B,46B,74B 'follow':32B 'github':26B 'github-act':25B 'link':36B,69B 'lint':21B,31B 'log':59B,78B 'may':83B 'output':62B 'outsid':40B 'packag':28B 'pars':49B 'part':85B 'point':67B 'print':51B 'project':42B 'public':76B 'pull':64B 'request':65B 'result':82B 'reveal':84B 'runner':72B 'sarif':61B 'scan':81B 'secret':88B 'symbol':35B 'yaml':48B","search_c":"'0.2.0':105C '0.32.0':107C,212C '30':152C 'action':177C 'appear':162C 'around':154C 'attack':157C,186C 'attacker-uncontrol':156C 'automat':111C 'cannot':187C 'caus':150C 'charact':153C 'code':197C 'compos':90C,95C,109C 'compose-lint':89C,108C 'compose-lint.yml':114C 'credenti':148C 'danger':100C 'deploy':103C 'disclos':191C 'docker':94C 'error':165C,167C,183C 'exact':190C 'execut':171C 'exit':180C 'extern':132C 'fail':134C 'file':117C,133C,144C,149C 'fix':209C 'follow':112C 'github':176C 'identifi':99C 'includ':124C 'issu':207C 'json':166C 'line':129C,192C 'link':119C 'lint':91C,110C 'linter':97C 'log':195C 'misconfigur':101C 'notif':172C 'output':199C 'outsid':120C 'pars':136C,159C 'part':125C,202C 'point':141C 'polici':116C,143C 'policy-fil':115C 'posit':160C 'project':122C 'public':194C 'pull':138C 'request':139C 'reveal':201C 'run':179C 'runner':147C 'sarif':169C 'scan':198C 'secur':96C 'select':188C 'standard':164C 'symbol':118C 'target':128C,205C 'tool':170C 'uncontrol':158C 'upload':173C 'version':211C 'yaml':135C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-28T16:12:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123371","severity":null,"published_at":"2026-11-09T18:17:26+00:00","modified_at":"2026-11-09T18:17:26+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","fetched_at":"2026-11-09T18:27:56+00:00","note":null}],"documents":[{"id":108801,"url":"https://github.com/tmatens/compose-lint/commit/e80547d33b2114040c4bc0e34ef210aee51f5058","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108802,"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":108803,"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-88f4-frh5-gmcr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-28T16:12:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}