GitHub CLI (gh) is GitHub's official command line tool. (CVE-2026-72924)
Description
GitHub CLI (gh) versions 2.28.0 through 2.97.0 have a security issue where the local listener created by the codespace ports forward feature binds to all network interfaces by default. This allows services running in a Codespace to be reachable via the user's non-loopback local IP addresses by other hosts on the same network, even if the Codespaces port itself remains private. The issue requires a network-adjacent attacker to access the victim's machine while port forwarding is active. The vulnerability is fixed in version 2.98.0.
CVSS v4.0
Affected software
pkg:deb/ubuntu/gh?arch=source&distro=jammypkg:deb/ubuntu/gh?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/gh?arch=source&distro=stonkingpkg:deb/ubuntu/gh?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
GitHub CLI (gh) versions 2.28.0 through 2.97.0 bind the local listener for codespace ports forwarding to all available network interfaces by default. This behavior exposes forwarded services on the user's local machine to other hosts on the same network, potentially allowing network-adjacent attackers to reach services that should remain private. The exposure is limited to the local machine's network interfaces and does not affect GitHub-side visibility of the Codespaces ports. The issue is resolved in version 2.98.0.
Potential Impact
An attacker on the same network as the victim can access forwarded services on the victim's machine that are intended to be private to the Codespace environment. This could lead to unauthorized access to services exposed via port forwarding while active. The impact is limited to network-adjacent attackers and requires the victim to have active port forwarding via GitHub CLI.
Mitigation Recommendations
Upgrade GitHub CLI (gh) to version 2.98.0 or later, where this issue is fixed. Until upgraded, avoid enabling codespace ports forwarding on untrusted or public networks to reduce exposure risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-72924
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:26.10","Ubuntu:Pro:26.04:LTS"]
- Cvss Version
- 4.0
Threat ID: 6ad3f58e2cdf04f6566621d9
Added to database: 10/17/2026, 22:24:14 UTC
Last enriched: 10/17/2026, 23:49:10 UTC
Last updated: 10/17/2026, 23:49:10 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.