---
id: "CVE-2026-123371"
page: "https://infrastack.ai/live/CVE-2026-123371"
kind: "vulnerability"
aliases: ["CVE-2026-123371"]
title: "compose-lint: symlinked policy file leaks fragments of runner credentials"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "compose-lint", "docker-compose", "github-actions", "package"]
not_affected_if: ["no-pull-request-triggers", "private-repositories", "version-0.32.0-or-later"]
published_at: "2026-11-09T18:17:26+00:00"
first_seen_at: "2026-11-09T18:27:56+00:00"
updated_at: "2026-11-09T18:29:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123371", "first_seen_at": "2026-11-09T18:27:56+00:00"}]
exploit_sources: []
---

# compose-lint: symlinked policy file leaks fragments of runner credentials

Link for people: https://infrastack.ai/live/CVE-2026-123371 (this .md is for agents)

compose-lint follows a .compose-lint.yml symbolic link to a file outside the project, and when that file fails YAML parsing it prints about 30 characters of its content into logs and SARIF output. A pull request can point the link at a runner credential file, so public CI logs or Code Scanning results may reveal part of that secret.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the compose-lint version in the project or action config: `compose-lint --version` or the action version pinned in the workflow
- Look at whether public workflows run compose-lint on pull requests from forks and upload SARIF to Code Scanning

## Fix

- compose-lint: move to `0.32.0`

## Timeline

- 2026-11-09T18:27:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123371

## Documents

- [advisory] Vendor advisory: github.com https://github.com/tmatens/compose-lint/security/advisories/GHSA-88f4-frh5-gmcr
- [fix] Patch: github.com https://github.com/tmatens/compose-lint/commit/e80547d33b2114040c4bc0e34ef210aee51f5058
- [fix] Release notes: github.com https://github.com/tmatens/compose-lint/releases/tag/v0.32.0

## From the sources

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project and includes part of the target line when that external file fails YAML parsing. A pull request can point the policy file at a runner credential file, causing about 30 characters around an attacker-uncontrolled parse position to appear in standard error, JSON errors, and SARIF tool execution notifications uploaded by the GitHub Action. The run exits with an error and the attacker cannot select the exact disclosed line, but public logs or Code Scanning output can reveal part of the target. This issue is fixed in version 0.32.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_