Debug Logging Exposure in Zizmor CI/CD Tool by Zizmorcore

CVE-2026-102289

What is CVE-2026-102289?

In version 1.27.0 of the Zizmor static analysis tool for CI/CD systems, a vulnerability exists in the debug logging mechanism. This issue causes sensitive GitHub credentials provided via environment variables, such as GH_TOKEN and GITHUB_TOKEN, to be recorded and displayed in cleartext within standard error output (stderr). Should the '-v' or '--verbose' option be activated, or if a specific RUST_LOG directive is configured, these credentials could inadvertently be exposed during normal operation or while performing online audits. If a third party gains access to CI logs, support artifacts, or any public documentation containing this output, they may exploit these credentials based on the access rights granted, leading to potential unauthorized actions. This vulnerability has been addressed in version 1.28.0.

References