CVE-2026-59947: Composer Credential Leak in Debug Output

Technical summary

The vulnerability stems from incomplete credential sanitization in Composer's AuthHelper, Url::sanitize, and ProcessExecutor components. When processing repository or package URLs containing embedded credentials in the username slot (e.g., https://TOKEN@host/), these components do not properly scrub the credentials before passing data to debug output. The issue only manifests when Composer runs with -vvv (maximum verbosity), which is typically used by developers during troubleshooting. The exposed credential format commonly includes GitHub Personal Access Tokens used for private repository access, though other authentication tokens in similar URL formats are equally at risk. This is classified as a log injection and information disclosure issue (CWE-532).

Business impact

Credential exposure in debug logs creates a pathway for unauthorized access to private code repositories and other authenticated resources. If debug output is captured, committed to version control, stored in logs, or shared during support interactions, attackers can extract valid tokens and assume the permissions of compromised accounts. For organizations relying on personal access tokens for CI/CD pipelines, development workflows, or automated package retrieval, a leaked token enables both lateral movement and data exfiltration. The impact is amplified in environments where verbose logging is enabled by default or where debug output is routinely collected for monitoring.

Affected systems

Composer versions prior to 2.2.29 (on the 2.2.x branch) and prior to 2.10.2 (on the 2.10.x branch) are affected. The vulnerability applies universally across operating systems and environments where Composer is deployed—development machines, build servers, CI/CD systems, and containerized environments. Any project using an affected version to manage dependencies is potentially at risk if debug verbosity is enabled or if developers routinely run high-verbosity commands.

Exploitability

Exploitability depends on opportunity rather than technical complexity. An attacker cannot trigger credential leakage remotely; the vulnerability requires a local or authenticated actor to run Composer with -vvv flag and then gain access to the resulting output. This might occur through log file access, terminal history, CI/CD log archives, or social engineering. The CVSS score of 4.7 (MEDIUM) reflects the local attack vector and requirement for privileged access to enable debug verbosity, balanced against the high confidentiality impact if credentials are obtained. Actual risk varies significantly based on organizational logging and access control practices.

Remediation

Upgrade Composer to version 2.2.29 or later (for 2.2.x users) or version 2.10.2 or later (for 2.10.x users). Both patched versions include credential sanitization fixes across AuthHelper, Url::sanitize, and ProcessExecutor. Additionally, organizations should audit existing debug logs for exposed tokens and rotate any credentials that may have been leaked. Review logging configurations to ensure debug verbosity is disabled in production and CI/CD environments unless absolutely necessary, and implement log access controls to restrict who can view build output and debug logs.

Patch guidance

Apply patches via your standard Composer update mechanism (composer self-update for the Composer binary itself, or dependency updates in composer.json for projects using Composer as a dependency). Verify that patched versions are in use by running composer --version and confirming the version number matches 2.2.29+ or 2.10.2+. After patching, clear any cached logs or debug output that may have been generated by unpatched versions. Test the patched version in a non-production environment first to ensure no workflow disruptions, particularly for projects with custom scripts that parse or rely on Composer output.

Detection guidance

Search historical CI/CD logs, developer terminal history, and version control commit messages for URLs containing credentials, particularly patterns like https://TOKEN@ or similar authentication markers. Monitor Composer debug output (when -vvv is enabled) for credential strings using SIEM log analysis rules. In development environments, use credential scanning tools such as git-secrets or truffleHog to detect exposed tokens in repositories. Establish baseline logging rules to alert when Composer runs with maximum verbosity in production systems, which would be unusual and warrant investigation.

Why prioritize this

While the CVSS score is MEDIUM, the practical risk is context-dependent but merits prompt attention. The vulnerability enables direct credential theft with high impact (unauthorized repository access), and the fix is straightforward and low-risk. Organizations with extensive debug logging, shared build environments, or strict CI/CD security postures should prioritize this patch. Teams managing sensitive or proprietary code repositories should treat this as higher priority. The low complexity of the fix makes this an efficient use of patching resources.

Risk score, explained

CVSS 4.7 reflects: local attack vector (requires local or authenticated access), high complexity to exploit (must enable debug verbosity and capture output), low privilege requirement (developer access suffices), and high confidentiality impact (credentials expose sensitive access). The score appropriately downgrades severity from HIGH because exploitation requires non-default behavior (maximum verbosity) and local access, but acknowledges the serious consequences of information disclosure.

Frequently asked questions