When debug logging is enabled, the application can write a supplied GitHub credential in cleartext to standard error.The flaw affects credentials provided through supported environment variables or command-line options. Default informational logging is unaffected, and zizmor 1.28.0 contains the fix.
What it allows
How Does CVE-2026-102289 Expose GitHub Credentials?
Version 1.27.0 added a debug representation of the fully parsed application configuration. That representation includes the credential retained for authenticated GitHub API requests during normal online operation.
An affected user must supply a credential and enable debug logging. Exposure occurs if another party can read the resulting standard-error output through a shared CI log, artifact, support record, bug report, or terminal capture.
The reader does not need to trigger another software flaw after the log is exposed. The possible impact depends on the credential's scope, repository access, and remaining lifetime.
Who is affected
zizmor 1.27.0 is the first and only affected release. Version 1.26.1 and earlier are unaffected, while version 1.28.0 is patched.
Exposure requires debug-level logging and a supplied GitHub credential. Teams should prioritize environments that retained verbose CI output, artifacts, support bundles, bug reports, or terminal captures from version 1.27.0.
What to do
-
Upgrade zizmor to version 1.28.0 or later
Remove version 1.27.0 from developer systems and automation. Confirm each CI image, lock file, and installed tool resolves version 1.28.0 or a later supported release.
-
Find debug output created by version 1.27.0
Review retained CI logs, artifacts, support records, bug reports, and terminal captures from runs that enabled verbose or debug logging. Limit access while the review is in progress.
-
Revoke and replace potentially exposed credentials
Brandefense recommends revoking credentials used in affected debug runs and issuing replacements with the minimum required scope. Do not rely only on removing a copied log.
-
Review use of exposed credential permissions
Brandefense recommends checking the relevant GitHub audit records for unexpected activity within each credential's access and lifetime. Escalate review for credentials with private-repository or write permissions.
-
Keep diagnostic output out of public channels
Restrict verbose logs and support bundles as potentially sensitive data. Redact credentials before sharing diagnostic output, even after upgrading the affected tool.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-102289?
It is a High-severity credential exposure vulnerability in zizmor 1.27.0. Debug logging can write a supplied GitHub credential in cleartext to standard error.
Which zizmor versions are affected by CVE-2026-102289?
Only version 1.27.0 is affected. Version 1.26.1 and earlier are unaffected, and version 1.28.0 is patched.
When can CVE-2026-102289 expose a credential?
The user must supply a GitHub credential and enable debug logging. Another party must then gain access to the resulting standard-error output.
What should teams do after running zizmor 1.27.0 with debug logging?
Upgrade, locate retained debug output, restrict its access, revoke the supplied credential, and review activity allowed by that credential's scope.
Is CVE-2026-102289 in CISA KEV?
It was not listed in CISA's Known Exploited Vulnerabilities catalog as of November 9, 2026.
