CVE-2026-124039
Description
A flaw was found in Gitleaks. When generating scan reports, the application creates output files with overly permissive default file permissions. A local user on a shared host or continuous integration (CI) environment can read these report files to obtain discovered plaintext credentials and secrets.
Statement
This vulnerability is rated as Low impact for Red Hat environments because exploitation requires existing local system access on the host or build runner where secrets scanning takes place. In multi-tenant environments or shared continuous integration systems, overly permissive file generation allows unprivileged local users to inspect output files. The flaw only impacts confidentiality and cannot lead to unauthorized code execution or system disruption.
Mitigation
To prevent unauthorized local users from reading generated reports, configure restrictive directory permissions, apply a strict umask prior to execution, or enable secret redaction.
1. Restrict the umask in the environment where the scan is executed:
bash
umask 077
gitleaks detect --report-path=/path/to/report.json
2. Alternatively, generate report files inside a directory restricted to the executing user:
bash
mkdir -p -m 700 /path/to/reports/
gitleaks detect --report-path=/path/to/reports/report.json
3. Pass the `--redact` flag to obscure identified credentials within the generated output:
bash
gitleaks detect --redact --report-path=/path/to/report.json
Caveats:
Enabling `--redact` prevents exposed secrets from appearing in plaintext within reports, which may affect subsequent automated workflows that depend on raw secret values. Setting strict permissions or umask may prevent other local service accounts from accessing reports unless explicitly granted permissions.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
