GitHub Actions leaking secrets when Miri output is cached

A security vulnerability has been discovered in GitHub Actions that could potentially expose secrets during the execution of Miri, a testing tool used in Rust projects. The issue arises due to Miri storing all environment variables in the target/ directory, which is then cached by GitHub Actions. This means that secrets could persist in caches and be accessed by pull requests (PRs) during CI runs, even though this behavior is not a vulnerability in itself.

GitHub Actions allows projects to cache directories between runs, typically used to speed up CI builds by caching binaries compiled by cargo install and sometimes the contents of target/. However, when a PR is triggered, CI can be rerun on every push, potentially leading to an attacker extracting information from the cached target/ directory and then clearing their tracks by pushing a second commit to the PR.

To mitigate this issue, the Rust Security Response Team has temporarily modified Miri to only preserve specific environment variables (CARGO_* and OUT_DIR) instead of storing all environment variables. In the longer term, the team plans to figure out better ways for Miri and cargo to inform Miri of the relevant list of environment variables. However, a short-term fix is to clear the cache and rotate any potentially leaked secrets.

The vulnerability has been identified in one GitHub repository and seven others that may not be vulnerable but should be cautious. The issue was reported by Predrag Gruevski and triaged and remediated by a team of developers. Miri will no longer have this problem in the upcoming nightly release (2026-09-22). It is also recommended that projects ensure jobs that write to public caches do not have access to secrets, as many tools do not handle secrets securely and assume the entire environment can be written to the filesystem.