Executive brief
GitHub CLI is a command-line interface for managing GitHub repositories and operations. Prior to version 2.97.0, the `gh auth status` command failed to properly mask authentication tokens when displayed, exposing parts of sensitive fine-grained personal access tokens and GitHub App tokens in terminal output or CI logs. An attacker who gains access to captured terminal output or CI logs could retrieve and misuse these partially-exposed tokens to access GitHub resources.
Technical details
The vulnerability is a cryptographic or authentication information disclosure issue in the token masking logic of the `gh auth status` command. The command masks only characters after the last underscore in token formats that include an underscore after the prefix (e.g., `github_pat_*`, `ghs_*`, `ghu_*`, and the Actions `GITHUB_TOKEN`), leaving the prefix and intermediate characters in plaintext. This affects authenticated users who run `gh auth status` without the `--show-token` flag. An attacker with access to terminal history, logs, or captured CI/CD output could recover the exposed portion of the token. Classic tokens (`gho_*`, `ghp_*`) are unaffected due to their underscore-free structure. The issue is fixed in version 2.97.0.
Affected products
- GitHub CLI prior to 2.97.0
Timeline
- 2026-08-06: disclosed
- 2026-07-31: patched: Fixed in version 2.97.0