# CVE-2026-123372: compose-lint unintended secret exposure in CL-0004 and CL-0019 findings

Source: https://junglewise.ai/threats/cve-2026-123372-compose-lint-is-a-docker-compose-security-linter-that-identifies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-123372 · Severity: medium · CVSS 4 · Published 2026-11-09

compose-lint is a Docker Compose security linter that checks containerized deployments for risky configurations. When a workflow writes secrets into a .env file and then lints untrusted code (such as a pull request), an attacker can reference a secret variable in the Docker image field so that its full value leaks into job logs, reports, and code scanning alerts. This only affects workflows using secret-bearing models like pull_request_target, not standard fork PRs.

Technologies: [tmatens/compose-lint (GitHub Actions)](https://junglewise.ai/threats/technologies/actions-tmatens-compose-lint), [compose-lint (PyPI)](https://junglewise.ai/threats/technologies/pypi-compose-lint). Vendors: [GitHub Actions](https://junglewise.ai/threats/vendors/actions), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-123372 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123372 being exploited in the wild.

**How severe is CVE-2026-123372?** Medium severity, with a CVSS score of 4, published 9 November 2026.

**Which products and versions are affected?** tmatens/compose-lint (GitHub Actions) >= 0.22.0, <= 0.31.0, ECOSYSTEM:introduced=0.22.0,fixed=0.32.0|GIT:introduced=811ef6b379dbc78d048fcedaf976205705d4a7c3,fixed=2d42617e4c6416f797bbfc6a057950131fa02df3; compose-lint (PyPI) >= 0.22.0, <= 0.31.0, ECOSYSTEM:introduced=0.22.0,fixed=0.32.0; Todd Matens Compose-Lint 0.22.0 to 0.32.0.

**Is there a fix for CVE-2026-123372?** Yes. tmatens/compose-lint (GitHub Actions): upgrade to 0.32.0 or later; compose-lint (PyPI): upgrade to 0.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123372 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123372?** Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Todd Matens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tmatens/compose-lint (GitHub Actions): upgrade to 0.32.0 or later
- compose-lint (PyPI): upgrade to 0.32.0 or later

  ```sh
  pip install "compose-lint>=0.32.0"
  ```


## Technical details

compose-lint versions 0.22.0–0.32.0 resolve .env variables in image fields and quote the resolved value in CL-0004 and CL-0019 finding messages and fix suggestions, leaking secret values into job logs, JSON output, SARIF artifacts, and Code Scanning alerts. An attacker who controls pull request content can set image: "${SECRET_VAR}" to expose the secret. The vulnerability requires a workflow that writes secrets into a sibling .env file before linting untrusted input; fork PRs normally lack secrets unless using pull_request_target or self-hosted runners with retained .env.

## Affected products

- Todd Matens compose-lint 0.22.0 to 0.32.0

## Identifiers

- CVE-2026-123372
- GHSA-jf3h-8jvx-vcrg

## Timeline

- 2026-11-09: disclosed
- 2026-09-28: patched

## References

- [https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2](https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2)
- [https://github.com/tmatens/compose-lint/pull/944](https://github.com/tmatens/compose-lint/pull/944)

## Related threats

- [compose-lint GitHub Action workflow command injection via symlink path](https://junglewise.ai/threats/cve-2026-125125-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint command injection via unsanitized stderr output](https://junglewise.ai/threats/cve-2026-125123-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint CI command injection in JSON and SARIF output](https://junglewise.ai/threats/cve-2026-125122-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint workflow command injection via Unicode whitespace](https://junglewise.ai/threats/cve-2026-125121-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint information disclosure via incomplete .env remediation at finding limit](https://junglewise.ai/threats/cve-2026-123796-compose-lint-is-a-docker-compose-security-linter-that-identifies)