LiveActive security incident?Get immediate response
CVE Record

CVE-2021-32638: CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated

Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-line parameter to the process instead of reading it from a file, standard input, or an environment variable. This approach made the token visible to other processes on the same machine, for example in the output of the `ps` command. If the CI system publicly exposes the output of `ps`, for example by logging the output, then the GitHub access token can be exposed beyond the scope intended. Users of the CodeQL runner on 3rd-party systems, who are passing a GitHub token via the `--github-auth` flag, are affected. This applies to both GitHub.com and GitHub Enterprise users. Users of the CodeQL Action on GitHub Actions are not affected. The `--github-auth` flag is now considered insecure and deprecated. The undocumented `--external-repository-token` flag has been removed. To securely provide a GitHub access token to the CodeQL runner, users should **do one of the following instead**: Use the `--github-auth-stdin` flag and pass the token on the command line via standard input OR set the `GITHUB_TOKEN` environment variable to contain the token, then call the command without passing in the token. The old flag remains present for backwards compatibility with existing workflows. If the user tries to specify an access token using the `--github-auth` flag, there is a deprecation warning printed to the terminal that directs the user to one of the above options. All CodeQL runner releases codeql-bundle-20210304 onwards contain the patches. We recommend updating to a recent version of the CodeQL runner, storing a token in your CI system's secret storage mechanism, and passing the token to the CodeQL runner using `--github-auth-stdin` or the `GITHUB_TOKEN` environment variable. If still using the old flag, ensure that process output, such as from `ps`, is not persisted in CI logs.

MediumCVSS 4.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-32638 is a credential exposure issue in the CodeQL runner for non-GitHub CI/CD systems. Older guidance allowed GitHub tokens to be passed on the command line, where other local processes or CI logs could reveal them. GitHub Actions users are not affected.

Executive priority

Treat this as a targeted CI credential hygiene issue, not a broad remote compromise. Prioritize teams running CodeQL outside GitHub Actions, especially where CI logs are widely accessible or retained.

Technical view

Affected CodeQL runner workflows passed GitHub access tokens via `--github-auth`, making tokens visible in process arguments, such as `ps` output. Exposure applies to third-party CI/CD users before `codeql-bundle-20210304`, including GitHub.com and GitHub Enterprise repositories. GitHub deprecated `--github-auth`, removed `--external-repository-token`, and added safer token-input options.

Likely exposure

Exposure is likely limited to organizations running CodeQL runner on third-party CI/CD systems, using versions before `codeql-bundle-20210304`, and passing tokens with `--github-auth`. Risk increases if CI logs persist process listings.

Exploitation context

No active exploitation is indicated by the provided sources, and the CVE is not in KEV. Exploitation requires access to process arguments on the CI machine, or access to logs that captured process output containing the token.

Researcher notes

The vulnerability is process-argument secret exposure, not code execution. The main exposure path is local process visibility plus possible CI log disclosure. The old flag remains for compatibility with a warning; safer alternatives are stdin or `GITHUB_TOKEN`. Evidence does not establish public exploitation.

Mitigation direction

  • Update CodeQL runner to `codeql-bundle-20210304` or a recent release.
  • Stop passing tokens with the deprecated `--github-auth` flag.
  • Use `--github-auth-stdin` to provide the token through standard input.
  • Alternatively, set the `GITHUB_TOKEN` environment variable before running CodeQL runner.
  • Store tokens in the CI system's secret storage mechanism.
  • Ensure process output, such as `ps`, is not persisted in CI logs.

Validation and detection

  • Inventory third-party CI/CD jobs using CodeQL runner.
  • Check whether runner versions are older than `codeql-bundle-20210304`.
  • Search CI configuration for `--github-auth` token usage.
  • Search CI configuration for removed `--external-repository-token` usage.
  • Review CI logs for process listings that may expose tokens.
  • Confirm GitHub Actions workflows are not treated as affected by this CVE.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-200: Information exposure and cloud metadata lookup

Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-214: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-32638 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.4CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N0.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.4Medium
CVSS 3.1 vector shape for CVE-2021-32638Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
githubcodeql-action< codeql-bundle-20210304Listed
Weakness

CWE details

CWE-200CWE-214

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-200 · source CWE mapping

Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-214 · source CWE mapping

Invocation of Process Using Visible Sensitive Information

Invocation of Process Using Visible Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs