AIKIDO-2026-10332

TL;DR

Affected versions of goreleaser are vulnerable to insertion of sensitive information into log files due to insufficient sanitization of values written to logs. Under certain conditions, authentication tokens or other sensitive configuration values may be included in log output, potentially exposing secrets to users who have access to build or CI logs. An attacker with access to these logs could retrieve the exposed credentials and use them to access external services or repositories.