World-readable Gitleaks report files via --report-path
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Gitleaks through 8.30.1 has an incorrect permission assignment flaw. The --report-path file is created with default permissions, so other local users can read scan reports. Unless --redact is passed, those reports contain plaintext secrets and matching lines, which can expose discovered credentials to local users on shared hosts or CI runners. CWE-732.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
The sources list no fixed version for gitleaks. Pass --redact to keep secrets out of the report file.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-11-06 Threatist record created from CVE-2026-124039
- 2026-11-06 Alias added: GHSA-w4h6-9gpx-7gm5
References
More gitleaks vulnerabilities
- TI-2026-45315 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature CVSS 4.0HIGH 8.1
Sources
- CVE-2026-124039 · CVE Program
- CVE-2026-124039 · NVD
- FIRST EPSS
- GHSA-w4h6-9gpx-7gm5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences