Is CVE-2026-123372 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123372 being exploited in the wild.

How severe is CVE-2026-123372?

Medium severity, with a CVSS score of 4, published 9 November 2026.

Which products and versions are affected?

tmatens/compose-lint (GitHub Actions) >= 0.22.0, = 0.22.0, <= 0.31.0, ECOSYSTEM:introduced=0.22.0,fixed=0.32.0; Todd Matens Compose-Lint 0.22.0 to 0.32.0.

Is there a fix for CVE-2026-123372?

Yes. tmatens/compose-lint (GitHub Actions): upgrade to 0.32.0 or later; compose-lint (PyPI): upgrade to 0.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123372 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123372?

Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Todd Matens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123372: compose-lint unintended secret exposure in CL-0004 and CL-0019 findings

Q: Is there a fix for CVE-2026-123372?

Yes. tmatens/compose-lint (GitHub Actions): upgrade to 0.32.0 or later; compose-lint (PyPI): upgrade to 0.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-123372 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-123372?

Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Todd Matens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123372 · Severity: medium · CVSS 4 · Published 2026-11-09

compose-lint is a Docker Compose security linter that checks containerized deployments for risky configurations. When a workflow writes secrets into a .env file and then lints untrusted code (such as a pull request), an attacker can reference a secret variable in the Docker image field so that its full value leaks into job logs, reports, and code scanning alerts. This only affects workflows using secret-bearing models like pull_request_target, not standard fork PRs.

Technologies: tmatens/compose-lint (GitHub Actions), compose-lint (PyPI). Vendors: GitHub Actions, PyPI.

Quick answers

Is CVE-2026-123372 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123372 being exploited in the wild.
How severe is CVE-2026-123372?: Medium severity, with a CVSS score of 4, published 9 November 2026.
Which products and versions are affected?: tmatens/compose-lint (GitHub Actions) >= 0.22.0, <= 0.31.0, ECOSYSTEM:introduced=0.22.0,fixed=0.32.0|GIT:introduced=811ef6b379dbc78d048fcedaf976205705d4a7c3,fixed=2d42617e4c6416f797bbfc6a057950131fa02df3; compose-lint (PyPI) >= 0.22.0, <= 0.31.0, ECOSYSTEM:introduced=0.22.0,fixed=0.32.0; Todd Matens Compose-Lint 0.22.0 to 0.32.0.
Is there a fix for CVE-2026-123372?: Yes. tmatens/compose-lint (GitHub Actions): upgrade to 0.32.0 or later; compose-lint (PyPI): upgrade to 0.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123372 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123372?: Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Todd Matens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tmatens/compose-lint (GitHub Actions): upgrade to 0.32.0 or later
compose-lint (PyPI): upgrade to 0.32.0 or later
```
pip install "compose-lint>=0.32.0"
```

Technical details

compose-lint versions 0.22.0–0.32.0 resolve .env variables in image fields and quote the resolved value in CL-0004 and CL-0019 finding messages and fix suggestions, leaking secret values into job logs, JSON output, SARIF artifacts, and Code Scanning alerts. An attacker who controls pull request content can set image: "${SECRET_VAR}" to expose the secret. The vulnerability requires a workflow that writes secrets into a sibling .env file before linting untrusted input; fork PRs normally lack secrets unless using pull_request_target or self-hosted runners with retained .env.

Affected products

Todd Matens compose-lint 0.22.0 to 0.32.0

Identifiers

CVE-2026-123372
GHSA-jf3h-8jvx-vcrg

Timeline

2026-11-09: disclosed
2026-09-28: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.