CVE-2026-124039 · Package
NO FIX YET
Gitleaks writes the --report-path scan report with default file permissions, so other local users can read it. Unless --redact is passed, the report contains plaintext secrets and the matching lines, which gives those users the credentials that were found.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone who runs Gitleaks through 8.30.1 with --report-path on a shared host or CI runner where other local users can access the output directory. Runs that pass --redact keep secret values out of the report. Remote-only use of Gitleaks, or machines where only the scanning user has access, are less exposed.
Not affected if no-report-path, redact-enabled, single-user-host
Who cares ci, gitleaks, shared-hosts
gitleaks version and compare against the fixed release in the sources, which the sources do not give: unknown--report-path without --redactls -l report.jsonUnknown from the sources.
Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.