# CVE-2026-123796: compose-lint information disclosure via incomplete .env remediation at finding limit

Source: https://junglewise.ai/threats/cve-2026-123796-compose-lint-is-a-docker-compose-security-linter-that-identifies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-123796 · Severity: medium · CVSS 4 · Published 2026-11-09

compose-lint is a Docker Compose security linter that checks for dangerous configuration errors before containers are deployed. In versions 0.32.0 to 0.33.0, when a Docker Compose configuration generates more than 20,000 security findings, the linter stops processing before replacing resolved secret values with variable references, leaking the actual secrets in its reports. An attacker who can contribute pull requests to a workflow that lints untrusted changes could trigger this flaw to expose secrets stored in .env files.

Technologies: [tmatens/compose-lint (GitHub Actions)](https://junglewise.ai/threats/technologies/actions-tmatens-compose-lint), [compose-lint (PyPI)](https://junglewise.ai/threats/technologies/pypi-compose-lint), [Tmatens Compose-Lint](https://junglewise.ai/threats/technologies/tmatens-compose-lint). Vendors: [GitHub Actions](https://junglewise.ai/threats/vendors/actions), [PyPI](https://junglewise.ai/threats/vendors/pypi), [Tmatens](https://junglewise.ai/threats/vendors/tmatens).

## Quick answers

**Is CVE-2026-123796 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123796 being exploited in the wild.

**How severe is CVE-2026-123796?** Medium severity, with a CVSS score of 4, published 9 November 2026.

**Which products and versions are affected?** tmatens/compose-lint (GitHub Actions) = 0.32.0, ECOSYSTEM:introduced=0.32.0,fixed=0.33.0|GIT:introduced=2d42617e4c6416f797bbfc6a057950131fa02df3,fixed=691e08bd1881ada886e3f556d0793079e8114451; compose-lint (PyPI) = 0.32.0, ECOSYSTEM:introduced=0.32.0,fixed=0.33.0; Tmatens Compose-Lint 0.32.0 to 0.33.0.

**Is there a fix for CVE-2026-123796?** Yes. tmatens/compose-lint (GitHub Actions): upgrade to 0.33.0 or later; compose-lint (PyPI): upgrade to 0.33.0 or later. Until then: Use the --allow-partial-coverage flag if upgrading is not immediately possible, though this does not prevent secret disclosure; the advisory recommends upgrading to 0.33.0 as the proper fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123796 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123796?** Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Tmatens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tmatens/compose-lint (GitHub Actions): upgrade to 0.33.0 or later
- compose-lint (PyPI): upgrade to 0.33.0 or later

  ```sh
  pip install "compose-lint>=0.33.0"
  ```


Use the --allow-partial-coverage flag if upgrading is not immediately possible, though this does not prevent secret disclosure; the advisory recommends upgrading to 0.33.0 as the proper fix.

## Technical details

compose-lint's 0.32.0 introduced a remediation to replace resolved .env values with ${NAME} references in findings output. However, the finding-limit early-exit path raises FindingLimitError before the _quote_references step completes, causing already-graded findings to emit with unredacted secret values in text, JSON, SARIF, and Code Scanning formats. Exploitation requires a workflow that places secrets in a sibling .env file and lints untrusted changes; the condition is triggered when a malicious document combines secret-referencing fields with aliased content exceeding 20,000 findings.

## Affected products

- tmatens compose-lint 0.32.0 to 0.33.0

## Identifiers

- CVE-2026-123796
- GHSA-rm8w-w798-g545

## Timeline

- 2026-11-09: disclosed
- 2026-10-04: patched

## References

- [https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3](https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3)
- [https://github.com/tmatens/compose-lint/pull/978](https://github.com/tmatens/compose-lint/pull/978)

## Related threats

- [compose-lint GitHub Action workflow command injection via symlink path](https://junglewise.ai/threats/cve-2026-125125-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint insufficient CI command sanitization](https://junglewise.ai/threats/cve-2026-125124-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint command injection via unsanitized stderr output](https://junglewise.ai/threats/cve-2026-125123-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint CI command injection in JSON and SARIF output](https://junglewise.ai/threats/cve-2026-125122-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint workflow command injection via Unicode whitespace](https://junglewise.ai/threats/cve-2026-125121-compose-lint-is-a-docker-compose-security-linter-that-identifies)