CVE-2026-102289

UNKNOWN 0.0

zizmor: Debug logging prints available GitHub credentials in cleartext

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0.

CWE	CWE-532
Vendor	zizmorcore
Product	zizmor
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for zizmorcore zizmor

Be the first to know when new unknown vulnerabilities affecting zizmorcore zizmor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

zizmorcore / zizmor

= 1.27.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh github.com: https://github.com/zizmorcore/zizmor/pull/2213 github.com: https://github.com/zizmorcore/zizmor/pull/2215 github.com: https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f github.com: https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f github.com: https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0