CVE-2026-123796 compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`
- Published
- Updated
- Exploit status
- No public exploit known
Description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tmatens compose-lint | = >= 0.32.0, < 0.33.0 | No fix listed |
| pypi compose-lint(PyPI) | >= 0.32.0, < 0.33.0 | 0.33.0 |
| pypi compose-lint(PyPI) | = 0.32.0 | No fix listed |
| github actions tmatens/compose-lint(GitHub Actions) | >= 0.32.0, < 0.33.0 | 0.33.0 |
| github actions tmatens/compose-lint(GitHub Actions) | = 0.32.0 | No fix listed |
| github actions tmatens/compose-lint(GitHub Actions) | = v0.32.0 | No fix listed |
| tmatens compose-lint(GitHub Actions) | = 0.32.0 | No fix listed |
References
- https://github.com/tmatens/compose-lint/security/advisories/GHSA-rm8w-w798-g545 vendor-advisory
- https://github.com/tmatens/compose-lint/pull/978 patch
- https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3 patch
- https://github.com/tmatens/compose-lint/releases/tag/v0.33.0
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com