PT-2026-40868 · Composer · Composer

CVE-2026-45793

Published

2026-05-14

Updated

2026-08-03

CVSS v3.1

7.5

High

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.9.8

Description A validation error in Composer causes GitHub tokens to be leaked into CI/CD logs.

Recommendations Update to version 2.9.8. Audit GitHub Action logs for leaked tokens.

Exploit

Fix

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾

BIT-COMPOSER-2026-45793

CVE-2026-45793

GHSA-F9F8-RM49-7JV2

OPENSUSE-SU-2026:11300-1

OPENSUSE-SU-2026:21520-1

SUSE-SU-2026:23116-1

SUSE-SU-2026:23138-1

SUSE-SU-2026:3105-1

Composer