CVE-2026-44479: Vercel CLI Information Disclosure Flaw

CVE-2026-44479 Overview

CVE-2026-44479 is an information disclosure vulnerability in the Vercel command-line interface (CLI). The flaw affects versions 50.16.0 through 52.0.0 when the CLI operates in non-interactive mode using the --non-interactive flag or through automatic AI agent detection. When users authenticate with the --token or -t flag, the CLI emits JSON payloads containing follow-up command suggestions that include the authentication token in plaintext. The token can then be captured in continuous integration and continuous deployment (CI/CD) logs, AI agent transcripts, or other automation output. Vercel resolved the issue in version 52.0.1. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Plaintext authentication tokens leak into CI/CD logs and AI agent transcripts, enabling unauthorized access to Vercel projects and deployments by anyone with log access.

Affected Products

Vercel CLI version 50.16.0 and later
Vercel CLI versions up to and including 52.0.0
Vercel CLI invocations using --token or -t in non-interactive or AI agent mode

Discovery Timeline

2026-05-13 - CVE-2026-44479 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44479

Vulnerability Analysis

The Vercel CLI provides a unified interface for deploying and managing applications on Vercel's AI Cloud platform. The CLI supports a non-interactive execution mode for automation environments such as CI/CD pipelines and AI coding agents. In this mode, the CLI cannot prompt the user to complete partial commands. Instead, it returns structured JSON payloads that suggest follow-up commands the user or automation can execute.

The vulnerability stems from the suggestion-generation logic copying the original command arguments verbatim into the suggested follow-up commands. When the original invocation included an authentication token through --token <value> or -t <value>, the token string is reproduced inside the emitted JSON. This information disclosure exposes a long-lived credential to any system that captures the CLI output.

Root Cause

The root cause is a failure to sanitize sensitive command-line arguments before including them in serialized output. The CLI did not redact or substitute token values when constructing suggested follow-up commands. This violates the principle of least exposure for secrets in automation tooling [CWE-200].

Attack Vector

The attack vector is local and requires user interaction, as reflected in the vector string. An attacker does not directly exploit the CLI. Instead, the attacker obtains the leaked token from secondary storage locations that captured the CLI's standard output. Common exposure points include CI/CD job logs in platforms such as GitHub Actions or GitLab CI, AI agent conversation transcripts retained by orchestration services, build artifacts, and shell history files. Once an attacker reads the token, they can authenticate to the Vercel API and act with the token holder's privileges.

No verified exploitation code is published. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-pgf8-2hgj-grqg.

Detection Methods for CVE-2026-44479

Indicators of Compromise

Presence of strings matching the Vercel token pattern inside CI/CD job logs, build artifacts, or AI agent transcripts.
JSON output from the Vercel CLI containing a --token or -t argument with a non-redacted value in the suggestions field.
Unexpected Vercel API activity from IP addresses or user agents associated with log aggregation, AI orchestration, or third-party tooling.

Detection Strategies

Scan historical CI/CD logs and AI agent transcripts for the Vercel token format and the literal substrings --token and -t followed by token-like values.
Audit Vercel CLI version usage across build environments and flag any invocation of versions 50.16.0 through 52.0.0.
Review Vercel audit logs for API calls originating from unfamiliar sources after periods of automated CLI usage.

Monitoring Recommendations

Enable Vercel audit logging and forward events to a centralized security information and event management (SIEM) system for correlation.
Configure CI/CD platforms to mask known secret patterns in job output and to redact environment variables in stored logs.
Alert on Vercel token usage from new geographic locations, automation platforms, or service accounts.

How to Mitigate CVE-2026-44479

Immediate Actions Required

Upgrade the Vercel CLI to version 52.0.1 or later across all developer workstations, CI/CD runners, and AI agent environments.
Rotate every Vercel authentication token that was used with affected CLI versions through --token or -t arguments.
Purge or restrict access to CI/CD logs and AI agent transcripts that may contain leaked tokens.
Replace command-line token passing with environment variable authentication where supported.

Patch Information

Vercel released the fix in Vercel CLI version 52.0.1. The patched release prevents the inclusion of token values in JSON suggestion payloads emitted during non-interactive execution. Patch details are documented in the Vercel Security Advisory GHSA-pgf8-2hgj-grqg.

Workarounds

Pass authentication tokens through the VERCEL_TOKEN environment variable instead of command-line flags.
Avoid running affected CLI versions with --non-interactive when the token must remain on the command line.
Restrict CI/CD log retention and limit log access to authorized personnel until upgrades are complete.
Configure secret scanning on source repositories and build platforms to detect accidental token exposure.

bash

# Configuration example: use environment variable instead of CLI flag
export VERCEL_TOKEN="<your-token>"
vercel deploy --non-interactive

# Verify the installed CLI version is patched
vercel --version
# Expected: 52.0.1 or later