CVE-2026-123796: compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Q: Which CI workflows are exposed to secret disclosure?

Exposure requires a workflow that writes secrets to a sibling .env file and runs compose-lint against untrusted changes, such as pull requests. The untrusted change must also be able to produce more than 20,000 findings while including a secret-referencing image field.

Q: What would an attacker need to trigger the leak?

An attacker needs to submit linted content that combines aliased content producing over 20,000 findings with an image field that references a secret from .env. User interaction is required according to the supplied severity vector.

Q: Where could disclosed values appear?

Resolved secret values can be emitted in compose-lint text output, JSON output, SARIF output, and Code Scanning output. Review retained CI logs and any systems that ingest these output formats for affected runs.

Q: What can be done if an immediate upgrade is not possible?

Avoid linting untrusted changes in workflows that create a sibling .env containing secrets. Do not use --allow-partial-coverage, because the affected run otherwise exits with code 2 when it reaches the finding limit.

Q: Which versions need remediation?

The issue affects compose-lint from 0.32.0 until 0.33.0 and is fixed in version 0.33.0. Upgrade to 0.33.0 and investigate prior qualifying CI runs for exposed output.

Published Nov 9, 2026

Updated

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.

Affected Software

1 affected component

compose-lint>=0.32.0<0.33.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade compose-lint to a version that resolves this vulnerability.
Fixed in 0.33.0

Event History

Nov 9, 2026

CVE Published

via MITRE·05:48 PM

Data Sourced

via MITRE·05:48 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which CI workflows are exposed to secret disclosure?

Exposure requires a workflow that writes secrets to a sibling .env file and runs compose-lint against untrusted changes, such as pull requests. The untrusted change must also be able to produce more than 20,000 findings while including a secret-referencing image field.

What would an attacker need to trigger the leak?

An attacker needs to submit linted content that combines aliased content producing over 20,000 findings with an image field that references a secret from .env. User interaction is required according to the supplied severity vector.

Where could disclosed values appear?

Resolved secret values can be emitted in compose-lint text output, JSON output, SARIF output, and Code Scanning output. Review retained CI logs and any systems that ingest these output formats for affected runs.

What can be done if an immediate upgrade is not possible?

Avoid linting untrusted changes in workflows that create a sibling .env containing secrets. Do not use --allow-partial-coverage, because the affected run otherwise exits with code 2 when it reaches the finding limit.

Which versions need remediation?

The issue affects compose-lint from 0.32.0 until 0.33.0 and is fixed in version 0.33.0. Upgrade to 0.33.0 and investigate prior qualifying CI runs for exposed output.

CVE-2026-123796: compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Affected Software

Remediation

Event History

Frequently Asked Questions

Which CI workflows are exposed to secret disclosure?

What would an attacker need to trigger the leak?

Where could disclosed values appear?

What can be done if an immediate upgrade is not possible?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Which CI workflows are exposed to secret disclosure?

What would an attacker need to trigger the leak?

Where could disclosed values appear?

What can be done if an immediate upgrade is not possible?

Which versions need remediation?