CVE-2026-123796 compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123796?
CVE-2026-123796 is a low-severity vulnerability in tmatens compose-lint, published on 9 Nov 2026.
Official description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.
Which versions are affected by CVE-2026-123796?
2 open source packages ship an affected version, including tmatens/compose-lint and compose-lint.
| Package | Affected | Fixed in |
|---|---|---|
tmatens/compose-lint GitHub Actions | From 0.32.0 | 0.33.0 |
compose-lint PyPI | From 0.32.0 | 0.33.0 |
How do I fix CVE-2026-123796?
Upgrade tmatens/compose-lint to 0.33.0 or later.
Is CVE-2026-123796 being exploited?
There is no known exploitation of CVE-2026-123796 in the wild and no public exploit code.
Sources
Also known as GHSA-rm8w-w798-g545.