CVE-2026-102289: zizmor: Debug logging prints available GitHub credentials in cleartext
zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables (GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN), or the corresponding command-line options (--gh-token, --github-token, --zizmor-github-token) are included in the debug representation of the parsed application configuration and written to stderr.
The affected logging is enabled by a single -v/--verbose or an applicable RUST_LOG directive.
References
- github.com/advisories/GHSA-f42p-wjw5-97qh
- github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f
- github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f
- github.com/zizmorcore/zizmor/pull/2213
- github.com/zizmorcore/zizmor/pull/2215
- github.com/zizmorcore/zizmor/releases/tag/v1.28.0
- github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh
- nvd.nist.gov/vuln/detail/CVE-2026-102289
Code Behaviors & Features
Detect and mitigate CVE-2026-102289 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →