Is CVE-2026-64652 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64652 being exploited in the wild.

How severe is CVE-2026-64652?

Low severity, with a CVSS score of 3.3, published 6 August 2026.

Which products and versions are affected?

github.com/cli/cli (Go) SEMVER:introduced=0; github.com/cli/cli/v2 (Go) < 2.97.0, SEMVER:introduced=0,fixed=2.97.0.

Is there a fix for CVE-2026-64652?

Yes. github.com/cli/cli/v2 (Go): upgrade to 2.97.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64652 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-64652?

Check whether you run github.com/cli/cli (Go) or github.com/cli/cli/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64652: GitHub CLI token masking bypass in auth status

Q: Is there a fix for CVE-2026-64652?

Yes. github.com/cli/cli/v2 (Go): upgrade to 2.97.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-64652 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-64652?

Check whether you run github.com/cli/cli (Go) or github.com/cli/cli/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64652 · Severity: low · CVSS 3.3 · Published 2026-08-06

GitHub CLI is a command-line interface for managing GitHub repositories and operations. Prior to version 2.97.0, the `gh auth status` command failed to properly mask authentication tokens when displayed, exposing parts of sensitive fine-grained personal access tokens and GitHub App tokens in terminal output or CI logs. An attacker who gains access to captured terminal output or CI logs could retrieve and misuse these partially-exposed tokens to access GitHub resources.

Technologies: github.com/cli/cli (Go), github.com/cli/cli/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-64652 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64652 being exploited in the wild.
How severe is CVE-2026-64652?: Low severity, with a CVSS score of 3.3, published 6 August 2026.
Which products and versions are affected?: github.com/cli/cli (Go) SEMVER:introduced=0; github.com/cli/cli/v2 (Go) < 2.97.0, SEMVER:introduced=0,fixed=2.97.0.
Is there a fix for CVE-2026-64652?: Yes. github.com/cli/cli/v2 (Go): upgrade to 2.97.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64652 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-64652?: Check whether you run github.com/cli/cli (Go) or github.com/cli/cli/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/cli/cli/v2 (Go): upgrade to 2.97.0 or later
```
go get github.com/cli/cli/v2@v2.97.0
```

Technical details

The vulnerability is a cryptographic or authentication information disclosure issue in the token masking logic of the `gh auth status` command. The command masks only characters after the last underscore in token formats that include an underscore after the prefix (e.g., `github_pat_*`, `ghs_*`, `ghu_*`, and the Actions `GITHUB_TOKEN`), leaving the prefix and intermediate characters in plaintext. This affects authenticated users who run `gh auth status` without the `--show-token` flag. An attacker with access to terminal history, logs, or captured CI/CD output could recover the exposed portion of the token. Classic tokens (`gho_*`, `ghp_*`) are unaffected due to their underscore-free structure. The issue is fixed in version 2.97.0.

Affected products

GitHub CLI prior to 2.97.0

Identifiers

CVE-2026-64652
GHSA-cg6r-mpgc-h9mm
GO-2026-6766

Timeline

2026-08-06: disclosed
2026-07-31: patched: Fixed in version 2.97.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.