{"affected":[{"product":"compose-lint","source":"CNA: GitHub_M","vendor":"tmatens","versions":[{"status":"affected","version":">= 0.32.0, < 0.33.0"}]}],"cveId":"CVE-2026-123796","cwes":["CWE-200","CWE-532"],"description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794246495456,"publishedAt":1794246495456,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-rm8w-w798-g545"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/pull/978"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.33.0"}],"remediation":[],"revision":"6556c92af296268859bbc94c65c677728cf0cd0c7df3248c515cf49551fc3cb0","sources":[{"modifiedAt":1794246495456,"name":"CNA: GitHub_M","retrievedAt":1794247836920,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123796"}],"ssvc":null,"status":"published","title":"compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`","updatedAt":1794247836920}