CVE-2026-48501

High

Advisory

Published 29 May 2026In the index since 8 Sept 2026

Severity: High; worst across findings
CVSS: 7.4; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1; of 17,781 indexed, latest versions
Container images: 1; deployed by those charts
Fix available: 1 of 1; affected package

GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands

Carried by container images the latest versions of 1 of 17,781 indexed charts deploy, on 1 image.

Affected package	Affected versions	Fixed in	Images
github.com/cli/cli/v2golang	v2.67.0	2.93.0	1

OSV records: GHSA-8xvp-7hj6-mcj9
Also known as: GO-2026-5271

Charts affected

1 by stars

Chart

Latest

Affected images

Radar Score

syncoor-serverethereum-helm-charts

0.0.1

1 of 1 See more

syncoor-server ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48501.

Container image	Digest	Package	Fixed in
ghcr.io/ethpandaops/syncoor :master	233aa9808fc7	github.com/cli/cli/v2@v2.67.0	2.93.0

Open the chart page →

952

Container images carrying it

1 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/ethpandaops/syncoor :master	233aa9808fc7	github.com/cli/cli/v2@v2.67.0	2.93.0	1