---
id: "CVE-2026-64652"
kind: "vulnerability"
aliases: ["CVE-2026-64652", "GHSA-cg6r-mpgc-h9mm", "GO-2026-6766"]
title: "GitHub CLI partially discloses authentication tokens in `gh auth status` output in github.com/cli/cli"
severity: "low"
cvss: 3.3
epss: 0.00155
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/cli/cli", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/cli/cli/v2", "fixed": ["2.97.0"], "affected": "< 2.97.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["ci", "github-actions", "github-cli", "go", "package"]
not_affected_if: ["classic-tokens-only", "gh-2.97.0-or-later", "gh-auth-status-not-run"]
published_at: "2026-08-06T22:18:13+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:49:22+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6766", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-64652", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64652", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# GitHub CLI partially discloses authentication tokens in `gh auth status` output in github.com/cli/cli

GitHub CLI's `gh auth status` masked only the part of certain tokens after the last underscore, so the start of a fine-grained PAT, GitHub App token, or Actions GITHUB_TOKEN could be printed. An attacker who can read that terminal output, CI log, or shared transcript gets part of a live token.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/cli/cli affected all versions fixed ?
- go:github.com/cli/cli/v2 affected < 2.97.0 fixed 2.97.0

## How to check

Run `gh --version` and check whether it is below 2.97.0.
Find CI jobs or scripts that run `gh auth status` without --show-token and check whether their logs are visible to others.

## Fix

Upgrade gh to 2.97.0 or later.
If output containing a github_pat_, ghs_, or ghu_ token was captured or shared, rotate that token.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6766
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-64652
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64652

## From the sources

GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output that is captured or shared. Authenticated users are affected if they ran gh auth status (without the --show-token flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens (github_pat_*) and GitHub App installation and user access tokens (ghs_*, ghu_*; for example, ghs_<APPID>_<JWT>), as well as the Actions GITHUB_TOKEN. Classic tokens such as gho_* and ghp_* have an underscore-free body and are not affected. This issue is fixed in version 2.97.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_