CVE-2026-124039

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-124039", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-06T19:08:41.309Z", "datePublished": "2026-11-06T19:14:48.275Z", "dateUpdated": "2026-11-09T13:17:23.098Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-06T19:14:48.275Z"}, "datePublic": "2026-10-09T00:00:00.000Z", "title": "Gitleaks through 8.30.1 World-Readable Report Files via --report-path", "descriptions": [{"lang": "en", "value": "Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Permission Assignment for Critical Resource", "cweId": "CWE-732", "type": "CWE"}]}], "affected": [{"vendor": "gitleaks", "product": "gitleaks", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/zricethezav/gitleaks/v8", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "8.30.1"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/gitleaks/gitleaks/issues/2299", "tags": ["issue-tracking"], "name": "GitHub Issue #2299"}, {"url": "https://github.com/gitleaks/gitleaks", "tags": ["product"]}, {"url": "https://github.com/gitleaks/gitleaks/blob/v8.30.1/cmd/root.go#L474", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Gitleaks through 8.30.1 World-Readable Report Files via --report-path", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/gitleaks-through-8.30.1-world-readable-report-files-via-report-path"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T13:17:13.541197Z", "id": "CVE-2026-124039", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T13:17:23.098Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-124039", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T13:17:13.541197Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T13:17:19.396Z"}}], "cna": {"title": "Gitleaks through 8.30.1 World-Readable Report Files via --report-path", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 4.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "gitleaks", "product": "gitleaks", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.30.1"}], "packageURL": "pkg:golang/github.com/zricethezav/gitleaks/v8", "defaultStatus": "unaffected"}], "datePublic": "2026-10-09T00:00:00.000Z", "references": [{"url": "https://github.com/gitleaks/gitleaks/issues/2299", "name": "GitHub Issue #2299", "tags": ["issue-tracking"]}, {"url": "https://github.com/gitleaks/gitleaks", "tags": ["product"]}, {"url": "https://github.com/gitleaks/gitleaks/blob/v8.30.1/cmd/root.go#L474", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/gitleaks-through-8.30.1-world-readable-report-files-via-report-path", "name": "VulnCheck Advisory: Gitleaks through 8.30.1 World-Readable Report Files via --report-path", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-06T19:14:48.275Z"}}}, "cveMetadata": {"cveId": "CVE-2026-124039", "state": "PUBLISHED", "dateUpdated": "2026-11-09T13:17:23.098Z", "dateReserved": "2026-11-06T19:08:41.309Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-06T19:14:48.275Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/zricethezav/gitleaks/v8", "product": "gitleaks", "vendor": "gitleaks", "versions": [{"lessThanOrEqual": "8.30.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials."}], "id": "CVE-2026-124039", "lastModified": "2026-11-12T21:30:23.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-124039", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T13:17:13.541197Z", "version": "2.0.3"}}]}, "published": "2026-11-06T20:17:22.037", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/gitleaks/gitleaks"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/gitleaks/gitleaks/blob/v8.30.1/cmd/root.go#L474"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/gitleaks/gitleaks/issues/2299"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/gitleaks-through-8.30.1-world-readable-report-files-via-report-path"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/gitleaks/gitleaks: gitleaks: Credential disclosure via insecure report file permissions", "id": "2568467", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568467"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-276", "details": ["Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials.", "A flaw was found in Gitleaks. When generating scan reports, the application creates output files with overly permissive default file permissions. A local user on a shared host or continuous integration (CI) environment can read these report files to obtain discovered plaintext credentials and secrets."], "mitigation": {"lang": "en:us", "value": "To prevent unauthorized local users from reading generated reports, configure restrictive directory permissions, apply a strict umask prior to execution, or enable secret redaction.\n1. Restrict the umask in the environment where the scan is executed:\n```bash\numask 077\ngitleaks detect --report-path=/path/to/report.json\n```\n2. Alternatively, generate report files inside a directory restricted to the executing user:\n```bash\nmkdir -p -m 700 /path/to/reports/\ngitleaks detect --report-path=/path/to/reports/report.json\n```\n3. Pass the `--redact` flag to obscure identified credentials within the generated output:\n```bash\ngitleaks detect --redact --report-path=/path/to/report.json\n```\nCaveats:\nEnabling `--redact` prevents exposed secrets from appearing in plaintext within reports, which may affect subsequent automated workflows that depend on raw secret values. Setting strict permissions or umask may prevent other local service accounts from accessing reports unless explicitly granted permissions."}, "name": "CVE-2026-124039", "public_date": "2026-11-06T19:14:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-124039\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-124039\nhttps://github.com/gitleaks/gitleaks\nhttps://github.com/gitleaks/gitleaks/blob/v8.30.1/cmd/root.go#L474\nhttps://github.com/gitleaks/gitleaks/issues/2299\nhttps://www.vulncheck.com/advisories/gitleaks-through-8.30.1-world-readable-report-files-via-report-path"], "statement": "This vulnerability is rated as Low impact for Red Hat environments because exploitation requires existing local system access on the host or build runner where secrets scanning takes place. In multi-tenant environments or shared continuous integration systems, overly permissive file generation allows unprivileged local users to inspect output files. The flaw only impacts confidentiality and cannot lead to unauthorized code execution or system disruption.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.30.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gitleaks", "source": "cna", "vendor": "gitleaks"}, "product": "gitleaks", "vendor": "gitleaks"}], "created": "2026-11-06T20:45:07.131495+00:00", "updated": "2026-11-06T20:45:07.547383+00:00", "vendors": ["gitleaks", "gitleaks$PRODUCT$gitleaks"]}