GitHub Actions leaking secrets when Miri output is cached
Rust's Miri tool stored all environment variables into target/, letting GitHub PR CI runs read cached secrets; fix ships in nightly 2026-09-22.
The Rust Security Response Team disclosed that Miri persists all environment variables to target/, which combined with GitHub Actions directory caching can expose secrets to pull request CI runs. Any contributor who previously landed a change can trigger a CI run that extracts cached secrets and cover their tracks via a second commit, since GitHub hides overwritten commits. The fix restricts Miri to preserving only CARGO_* variables (excluding tokens) and OUT_DIR, shipping in the 2026-09-22 nightly. An ecosystem scan found one affected repository; affected users should clear caches and rotate potentially leaked secrets.
- Miri wrote all environment variables to target/, persisting secrets in GitHub Actions caches
- PR CI runs by prior contributors could extract cached secrets and hide evidence via overwritten commits
- Fixed in nightly 2026-09-22 by limiting Miri to CARGO_* and OUT_DIR variables
- Affected users should clear caches and rotate secrets; one repository found vulnerable
- Organizations
- Rust Security Response TeamMiriGitHub ActionsOpenAI
From the original article
3 min read at blog.rust-lang.org
The Rust Security Response Team was notified that Miri stores all environment variables to target/ , allowing secrets to persist in caches. While not necessary a vulnerability in and of itself, when paired with GitHub Actions caching behavior, it is possible for this to expose secrets to PRs. GitHub Actions makes it possible to cache directories between runs.
By blog.rust-lang.org via peter · blog.rust-lang.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.