CVE-2026-64652

Name of the Vulnerable Software and Affected Versions GitHub CLI (gh) versions prior to 2.97.0

Description The gh auth status command improperly masks certain token types, specifically fine-grained personal access tokens (github pat *), GitHub App installation and user access tokens (ghs *, ghu *), and the Actions GITHUB TOKEN. The tool only masks characters following the final underscore, potentially exposing parts of the token in terminal or CI output. This occurs when the command is executed without the --show-token flag for tokens containing an underscore after the prefix.

Recommendations Update to version 2.97.0.