CVE Intelligence
Analysis AI-assisted

CVE-2026-48501: GitHub CLI token exposure via gh attestation commands

GitHub CLI versions before 2.93.0 can send the user's GitHub token to external hosts contacted by the attestation and release verification commands. Host matching wrongly treats any github.com subdomain as github.com, so the token is attached to requests bound for unrelated hosts. The record gives NVD CVSS 3.1 9.1 and lists 2.93.0 as the fixed version; it is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The GitHub CLI (gh) can attach the user's GitHub token to requests sent to hosts that are not GitHub API endpoints. The flaw is in host normalization, which collapses any subdomain of github.com into github.com. The record ties the issue to the gh attestation, gh release verify and gh release verify-asset commands.

Impact

  • A GitHub token may be disclosed to third-party or unrelated hosts contacted during attestation and release verification.
  • The record describes the confidentiality and integrity impact as high and availability as none (CVSS 3.1 vector C:H/I:H/A:N).
  • If the GH_ENTERPRISE_TOKEN variable is set, hosts that match no known instance may also receive that token, according to the record.

Affected products and versions

  • GitHub CLI (gh) before 2.93.0. The record lists the product under two names, Cli Cli and Github Cli, with the same range.
  • The fixed version is 2.93.0.

Exploitation status

CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted. The SSVC data in the record marks exploitation as none and automatable as no. EPSS is 0.00446 (percentile 0.37787) as of the record date.

Remediation and mitigation

  • Update GitHub CLI to version 2.93.0 or later, as stated in the record.
  • The advisory GHSA-8xvp-7hj6-mcj9 is listed in the record as a mitigation reference.
  • Inference: after updating, consider rotating GitHub tokens used on systems where affected versions ran these commands, especially where GH_ENTERPRISE_TOKEN was set.

Detection guidance

  • Inventory hosts and CI runners that have GitHub CLI installed and identify versions earlier than 2.93.0.
  • Review audit logs and token usage for unexpected activity after these commands were run on older versions.
  • Confirm whether the commands ran in environments where broad-scope tokens were available.

Limitations of the available information

The record does not state the exact conditions needed to trigger the flaw in every environment, nor any observed exploitation. The record's two CVSS 3.1 scores differ: 9.1 from NVD and 7.4 from GitHub; both are reported here as given. Details beyond the record, including the full advisory text, were not reviewed.

Frequently asked questions

Which GitHub CLI versions are affected by CVE-2026-48501?

The record lists GitHub CLI versions before 2.93.0 as affected. Version 2.93.0 is the fixed version stated in the record.

Which commands trigger the token exposure?

The record names gh attestation, gh release verify and gh release verify-asset as the commands whose requests go through the affected authenticated HTTP client.

Is this vulnerability known to be actively exploited?

No. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Update GitHub CLI to 2.93.0 or later. Consider rotating tokens on systems that ran affected versions, especially where GH_ENTERPRISE_TOKEN was set.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.