CVE-2026-102289 — zizmor: Debug logging prints available GitHub credentials in cleartext

Exploitation evidence

Not listed in the latest downloaded CISA KEV catalog. This does not establish an absence of exploitation.

KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗

Reported products and versions

zizmorcore / zizmor

Default status: Not specified

affected: = 1.27.0

Fixes and workarounds

No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.

Sources and related reporting

CVE Program record ↗ · Download tracked evidence as JSON

Monitored source mentions

GitHub Advisory Database — zizmor: Debug logging prints available GitHub credentials in cleartext ↗

Shared CVE identifiers link source mentions; they do not establish that the reports describe the same incident.

Observed change timeline

History begins when Egret first downloads each source. It is not the complete upstream CVE history.

12 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-12",
  "epss": 0.00244,
  "percentile": 0.15793
}

10 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-10",
  "epss": 0.00244,
  "percentile": 0.1576
}

10 Nov 2026, 12:20 Jerusalem · CVE Program record changed

Stored CNA snapshot at this observation.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "zizmor",
          "vendor": "zizmorcore",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.27.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T21:37:32.457Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/pull/2213",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/pull/2213"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/pull/2215",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/pull/2215"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f42p-wjw5-97qh",
        "discovery": "UNKNOWN"
      },
      "title": "zizmor: Debug logging prints available GitHub credentials in cleartext"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102289",
    "datePublished": "2026-11-09T21:37:32.457Z",
    "dateReserved": "2026-09-28T20:11:16.659Z",
    "dateUpdated": "2026-11-09T21:37:32.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}