---
id: "CVE-2026-123796"
page: "https://infrastack.ai/live/CVE-2026-123796"
kind: "vulnerability"
aliases: ["CVE-2026-123796"]
title: "compose-lint: large pull requests leak .env secrets in linter output"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "code-scanning", "docker-compose", "github-actions", "package"]
not_affected_if: ["fixed-0.33.0", "no-secrets-in-env-file", "trusted-code-only"]
published_at: "2026-11-09T18:17:26+00:00"
first_seen_at: "2026-11-09T18:27:56+00:00"
updated_at: "2026-11-09T18:29:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123796", "first_seen_at": "2026-11-09T18:27:56+00:00"}]
exploit_sources: []
---

# compose-lint: large pull requests leak .env secrets in linter output

Link for people: https://infrastack.ai/live/CVE-2026-123796 (this .md is for agents)

compose-lint, a Docker Compose security linter, prints resolved .env secret values in its findings when a scan exceeds 20,000 findings. An attacker who can submit a pull request can get a CI run to expose the secret in text, JSON, SARIF, and Code Scanning output.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed compose-lint version with `compose-lint --version` or the lockfile entry; versions from `0.32.0` up to but not including `0.33.0` are affected.
- Look for CI workflows that write secrets into a `.env` file next to the Compose file and then lint pull requests from untrusted forks or branches.
- Check whether those lint runs use `--allow-partial-coverage`, since the sources say the exit code is 2 without it.

## Fix

- compose-lint: upgrade to `0.33.0`

## Timeline

- 2026-11-09T18:27:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123796

## Documents

- [advisory] Vendor advisory: github.com https://github.com/tmatens/compose-lint/security/advisories/GHSA-rm8w-w798-g545
- [fix] Patch: github.com https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3
- [fix] Release notes: github.com https://github.com/tmatens/compose-lint/releases/tag/v0.33.0

## From the sources

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_