Authorization token leakage in GitHub CLI attestation and release verify commands (CVE-2026-48501)

GitHub CLI incorrectly attaches authentication tokens to outgoing HTTP requests made to TUF repository mirrors during `gh attestation`, `gh release verify`, and `gh release verify-asset` operations. A flawed host normalization routine causes the `github.com` token to be sent to `tuf-repo.github.com` (a GitHub Pages domain), and the enterprise token to be sent to third-party hosts `tuf-repo-cdn.sigstore.dev` and `tmaproduction.blob.core.windows.net`. If captured, a leaked token could grant unauthorized access to private repositories, organization resources, or enterprise administration functions depending on token type and permissions. Affected versions: - <= v2.92.0 We recommend updating to: v2.93.0. CVSS 9.1 · our assessment: act_now Reference: https://github.com/cli/cli/security/advisories/GHSA-8xvp-7hj6-mcj9 Details: https://vuln.today/cve/CVE-2026-48501