CVE-2026-124039

LowCVSS 3.3

Published: 06/11/2026(UTC)Updated: 09/11/2026(UTC)Translated: 06/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability. The --report-path file is created by cmd/root.go using os.Create with default permissions, allowing local users to read scan reports.

Risk Assessment

Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials.

Recommendation

Update Gitleaks beyond 8.30.1 when available, use the --redact option, and restrict report file permissions on shared hosts and CI runners.

Other vulnerabilities in Gitleaks

CVE-2026-63728Medium
Gitleaks prior to 8.30.1 contains a template injection vulnerability allowing attackers to read environment variables and exfiltrate sensitive data via Sprig template functions.

Original NVD description (English source)

Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS