CVE-2026-72924: GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default
GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the user's non-loopback local IP addresses by other hosts that can route to the user's machine. This behavior does not change the GitHub-side visibility of the Codespaces port. Instead, it exposes the forwarded service through a wildcard-bound listener on the user's local machine, even when the source Codespaces port remains private. Exploitation requires a network-adjacent attacker to reach the victim's machine while forwarding is active. This issue is fixed in version 2.98.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitHub CLI (gh)to a version that resolves this vulnerability.Fixed in 2.98.0 - Compensating control
While using GitHub CLI versions 2.28.0 through 2.97.0, prevent other hosts from routing to the user's machine non-loopback local IP addresses while `gh codespace ports forward` is active (e.g., block inbound access to the forwarded local wildcard-bound listener at the network/firewall layer).
Event History
Frequently Asked Questions
Who can reach the forwarded service while the vulnerable command is active?
Other hosts that can route to the user's machine through its non-loopback local IP addresses can reach it. The attacker must be network-adjacent and the port forwarding session must still be active.
Does making the Codespaces port private prevent this local exposure?
No. The issue does not change GitHub-side Codespaces port visibility; even a private source port can be exposed by the wildcard-bound listener on the local machine.
Which versions are affected, and what version fixes the issue?
GitHub CLI versions 2.28.0 through 2.97.0 are affected. The issue is fixed in version 2.98.0.