CVE-2026-72924 GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default
GitHub CLI binds port forwarding to all interfaces by default, exposing local services to network-adjacent attackers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72924?
CVE-2026-72924 is a low-severity vulnerability in cli, published on 25 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the user's non-loopback local IP addresses by other hosts that can route to the user's machine. This behavior does not change the GitHub-side visibility of the Codespaces port. Instead, it exposes the forwarded service through a wildcard-bound listener on the user's local machine, even when the source Codespaces port remains private. Exploitation requires a network-adjacent attacker to reach the victim's machine while forwarding is active. This issue is fixed in version 2.98.0.
Which versions are affected by CVE-2026-72924?
How do I fix CVE-2026-72924?
Upgrade to a fixed version.
Is CVE-2026-72924 being exploited?
There is no known exploitation of CVE-2026-72924 in the wild and no public exploit code.
Sources
Also known as AZL-98198, DEBIAN-CVE-2026-72924, GHSA-vfhh-p7hm-pxfh, UBUNTU-CVE-2026-72924.