zizmor: GitHub credential exposure in debug logs (CVE-2026-102289)

Version 1.27.0 of the zizmor security tool contains a vulnerability (CVE-2026-102289) where GitHub credentials are logged to stderr in cleartext when the application is run with debug-level logging enabled. The issue arises from a derived Debug implementation on internal CLI configuration types, which causes tokens provided via environment variables (GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN) or command-line flags to be printed during runtime initialization. The vulnerability is triggered by the -v or --verbose flags. While GitHub maintains automated secret scanning and redaction in some contexts, the credentials remain at risk if the stderr output is captured, saved to CI artifacts, or pasted into public support channels.

Impact

The impact is contingent on the scope and permissions associated with the leaked GitHub token. An unauthorized party with access to the disclosed logs could potentially leverage the token to read private repositories, modify workflows, or access organization resources depending on the specific token privileges.

Recommendation

• Update zizmor to a version newer than 1.27.0 immediately.
• Rotate any GitHub tokens that may have been included in logs generated by zizmor 1.27.0 while running with --verbose.
• Audit CI/CD pipeline artifacts and internal bug tracking systems for instances of zizmor verbose output to ensure no tokens were inadvertently persisted.
• Implement local log masking for CI/CD runners if debug-level logging is required for operational troubleshooting.