{"history":[{"alert":0,"cve":"CVE-2026-102289","id":23034,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.00244, \"percentile\": 0.15793}"},{"alert":0,"cve":"CVE-2026-102289","id":20657,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.00244, \"percentile\": 0.1576}"},{"alert":1,"cve":"CVE-2026-102289","id":18932,"kind":"cna","observed_at":1794306001,"payload":"{\"containers\": {\"cna\": {\"affected\": [{\"product\": \"zizmor\", \"vendor\": \"zizmorcore\", \"versions\": [{\"status\": \"affected\", \"version\": \"= 1.27.0\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0.\"}], \"metrics\": [{\"cvssV4_0\": {\"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"attackVector\": \"LOCAL\", \"baseScore\": 7, \"baseSeverity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"subAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"subIntegrityImpact\": \"HIGH\", \"userInteraction\": \"ACTIVE\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"NONE\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-532\", \"description\": \"CWE-532: Insertion of Sensitive Information into Log File\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-09T21:37:32.457Z\", \"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\"}, \"references\": [{\"name\": \"https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh\"}, {\"name\": \"https://github.com/zizmorcore/zizmor/pull/2213\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/zizmorcore/zizmor/pull/2213\"}, {\"name\": \"https://github.com/zizmorcore/zizmor/pull/2215\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/zizmorcore/zizmor/pull/2215\"}, {\"name\": \"https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f\"}, {\"name\": \"https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f\"}, {\"name\": \"https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0\"}], \"source\": {\"advisory\": \"GHSA-f42p-wjw5-97qh\", \"discovery\": \"UNKNOWN\"}, \"title\": \"zizmor: Debug logging prints available GitHub credentials in cleartext\"}}, \"cveMetadata\": {\"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"assignerShortName\": \"GitHub_M\", \"cveId\": \"CVE-2026-102289\", \"datePublished\": \"2026-11-09T21:37:32.457Z\", \"dateReserved\": \"2026-09-28T20:11:16.659Z\", \"dateUpdated\": \"2026-11-09T21:37:32.457Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"product":"zizmor","vendor":"zizmorcore","versions":[{"status":"affected","version":"= 1.27.0"}]}],"cna":{"containers":{"cna":{"affected":[{"product":"zizmor","vendor":"zizmorcore","versions":[{"status":"affected","version":"= 1.27.0"}]}],"descriptions":[{"lang":"en","value":"zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0."}],"metrics":[{"cvssV4_0":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":7,"baseSeverity":"HIGH","privilegesRequired":"NONE","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-532","description":"CWE-532: Insertion of Sensitive Information into Log File","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T21:37:32.457Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh","tags":["x_refsource_CONFIRM"],"url":"https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh"},{"name":"https://github.com/zizmorcore/zizmor/pull/2213","tags":["x_refsource_MISC"],"url":"https://github.com/zizmorcore/zizmor/pull/2213"},{"name":"https://github.com/zizmorcore/zizmor/pull/2215","tags":["x_refsource_MISC"],"url":"https://github.com/zizmorcore/zizmor/pull/2215"},{"name":"https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f","tags":["x_refsource_MISC"],"url":"https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f"},{"name":"https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f","tags":["x_refsource_MISC"],"url":"https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f"},{"name":"https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0","tags":["x_refsource_MISC"],"url":"https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0"}],"source":{"advisory":"GHSA-f42p-wjw5-97qh","discovery":"UNKNOWN"},"title":"zizmor: Debug logging prints available GitHub credentials in cleartext"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-102289","datePublished":"2026-11-09T21:37:32.457Z","dateReserved":"2026-09-28T20:11:16.659Z","dateUpdated":"2026-11-09T21:37:32.457Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794435601,"cve":"CVE-2026-102289","description":"zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0.","epss":{"date":"2026-11-12","epss":0.00244,"percentile":0.15793},"epss_checked":1794522003,"first_seen":1794290405,"kev":null,"kev_checked":1794522003,"products":"zizmorcore zizmor","references":["https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh","https://github.com/zizmorcore/zizmor/pull/2213","https://github.com/zizmorcore/zizmor/pull/2215","https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f","https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f","https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0"],"score":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":7,"baseSeverity":"HIGH","privilegesRequired":"NONE","provider":"GitHub_M","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE"},"solutions":"","state":"PUBLISHED","title":"zizmor: Debug logging prints available GitHub credentials in cleartext","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://github.com/advisories/GHSA-f42p-wjw5-97qh","id":274,"publisher":"GitHub Advisory Database","title":"zizmor: Debug logging prints available GitHub credentials in cleartext"}]}