CVE-2026-123796: compose-lint information disclosure via incomplete .env remediation at finding limit

CVE-2026-123796 · Severity: medium · CVSS 4 · Published 2026-11-09

compose-lint is a Docker Compose security linter that checks for dangerous configuration errors before containers are deployed. In versions 0.32.0 to 0.33.0, when a Docker Compose configuration generates more than 20,000 security findings, the linter stops processing before replacing resolved secret values with variable references, leaking the actual secrets in its reports. An attacker who can contribute pull requests to a workflow that lints untrusted changes could trigger this flaw to expose secrets stored in .env files.

Technologies: tmatens/compose-lint (GitHub Actions), compose-lint (PyPI), Tmatens Compose-Lint. Vendors: GitHub Actions, PyPI, Tmatens.

Quick answers

Is CVE-2026-123796 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123796 being exploited in the wild.
How severe is CVE-2026-123796?
Medium severity, with a CVSS score of 4, published 9 November 2026.
Which products and versions are affected?
tmatens/compose-lint (GitHub Actions) = 0.32.0, ECOSYSTEM:introduced=0.32.0,fixed=0.33.0|GIT:introduced=2d42617e4c6416f797bbfc6a057950131fa02df3,fixed=691e08bd1881ada886e3f556d0793079e8114451; compose-lint (PyPI) = 0.32.0, ECOSYSTEM:introduced=0.32.0,fixed=0.33.0; Tmatens Compose-Lint 0.32.0 to 0.33.0.
Is there a fix for CVE-2026-123796?
Yes. tmatens/compose-lint (GitHub Actions): upgrade to 0.33.0 or later; compose-lint (PyPI): upgrade to 0.33.0 or later. Until then: Use the --allow-partial-coverage flag if upgrading is not immediately possible, though this does not prevent secret disclosure; the advisory recommends upgrading to 0.33.0 as the proper fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123796 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-123796?
Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Tmatens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tmatens/compose-lint (GitHub Actions): upgrade to 0.33.0 or later
  • compose-lint (PyPI): upgrade to 0.33.0 or later
    pip install "compose-lint>=0.33.0"

Use the --allow-partial-coverage flag if upgrading is not immediately possible, though this does not prevent secret disclosure; the advisory recommends upgrading to 0.33.0 as the proper fix.

Technical details

compose-lint's 0.32.0 introduced a remediation to replace resolved .env values with ${NAME} references in findings output. However, the finding-limit early-exit path raises FindingLimitError before the _quote_references step completes, causing already-graded findings to emit with unredacted secret values in text, JSON, SARIF, and Code Scanning formats. Exploitation requires a workflow that places secrets in a sibling .env file and lints untrusted changes; the condition is triggered when a malicious document combines secret-referencing fields with aliased content exceeding 20,000 findings.

Affected products

  • tmatens compose-lint 0.32.0 to 0.33.0

Identifiers

  • CVE-2026-123796
  • GHSA-rm8w-w798-g545

Timeline

  • 2026-11-09: disclosed
  • 2026-10-04: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.