CVE-2026-64652 GitHub CLI: Partial token disclosure in `gh auth status` output

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

CVE-2026-64652

The CVE covers GitHub CLI (gh) prior to v2.97.0, where gh auth status could reveal part of certain tokens in output. Affected tokens include fine-grained PATs (github_pat_) and GitHub App tokens (ghs_ and ghu_*), plus the Actions GITHUB_TOKEN, whenever the token format contains an underscore afte...