zizmor: Debug logging prints available GitHub credentials in cleartext
Affects zizmor 1.27.0 when debug logging is enabled and a GitHub token is supplied through environment variables or command-line options. Fixed in 1.28.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 1.28.0
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected version is zizmor 1.27.0 (1.26.1 and earlier are unaffected). Debug logging is enabled, via a single -v / --verbose or an applicable RUST_LOG directive. A GitHub credential is supplied via GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, or the matching command-line options. Explicit --offline is not used, since it clears the token; normal online operation or --no-online-audits retains it.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 22/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Zizmor, a static analysis tool for CI/CD systems, can write GitHub credentials in cleartext to stderr when debug logging is enabled, which happens with a single -v or --verbose option or a matching RUST_LOG directive. Anyone who can read the resulting CI log, support artifact, terminal capture, or public bug report can use the exposed token within its scopes, repository access, and lifetime, and the access requires local access with user action.
Read the original description
zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach10/20Affects PyPI packages
- Severity7/10CVSS 7.0
- No patch0/5No signal
What would change the score
- Would score about 72 if added to CISA KEV
- Would score about 67 if CISA's SSVC rates exploitation active
- Would score about 32 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affected version is zizmor 1.27.0 (1.26.1 and earlier are unaffected). Debug logging is enabled, via a single -v / --verbose or an applicable RUST_LOG directive. A GitHub credential is supplied via GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, or the matching command-line options. Explicit --offline is not used, since it clears the token; normal online operation or --no-online-audits retains it.Upgrade to a fixed version: 1.28.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- zizmorcore zizmor
1.27.0
- zizmorPyPI
From 1.27.0 · fixed in 1.28.0
Evidence 6
- Advisory
- Repository
- Repository
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-102289
Is CVE-2026-102289 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
With debug-level logging turned on, zizmor prints GitHub access tokens in cleartext in its log output. Anyone who can read those logs can see the tokens.Source: github.com
Which versions are affected by CVE-2026-102289?
zizmor: version 1.27.0. zizmor (PyPI): from 1.27.0 before 1.28.0.Source: cve.now feed data
Am I affected, and how do I check?
The affected version is zizmor 1.27.0; 1.26.1 and earlier are unaffected, and the fix is in 1.28.0. The version can be checked with zizmor --version. The bug needs debug logging, enabled by a single -v/--verbose or an applicable RUST_LOG directive, and a token supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, or the matching command-line options. Explicit --offline clears the token, while normal online operation or --no-online-audits keeps it.Source: github.com
How do I fix CVE-2026-102289?
Upgrade zizmor to 1.28.0 or later.Source: github.com