Rust Security Advisory Uncovers CI Secret Leaks via GitHub Actions Cache Persistence

The Rust Security Response Team published a security advisory detailing a vulnerability where Miri, an interpreter for Rust's mid-level intermediate representation, persisted all environment variables to the target directory. When paired with standard GitHub Actions caching configurations—where build artifacts are saved from primary branches and restored in pull request builds—untrusted pull request runs could read the cached target directory and expose sensitive repository secrets. This finding is significant for platform engineers and CI/CD maintainers because it subverts common continuous integration threat models. In typical GitHub Actions pipelines, pull requests from contributors are treated as untrusted and denied direct access to repository secrets. However, many teams configure workflows to accelerate builds by sharing caching layers (such as target directories or cargo dependencies) populated by protected branches. Because Miri recorded the complete environment state to disk, any credential available during upstream cache generation became readable by subsequent pull request executions, enabling attackers with pull request trigger privileges to silently harvest credentials. This incident reinforces a broader, accelerating trend across software supply chain security: build caches and intermediate compilation artifacts are increasingly becoming potent attack vectors. As CI platforms like GitHub Actions harden direct token permissions, branch triggers, and OIDC integrations, threat actors and security researchers are targeting peripheral state storage. Similar patterns have emerged across package registries and shared runners, demonstrating that tooling which assumes local developer machine semantics often fails to uphold cloud-native security boundaries in shared pipeline environments. Practitioners running Rust workloads or any automated testing pipelines in GitHub Actions should take immediate action. Teams using Miri in cached jobs must upgrade to the patched nightly toolchain, manually purge existing GitHub Actions caches, and rotate any secrets that were accessible to caching jobs. More broadly, DevOps engineers must adopt defense-in-depth cache hygiene: restrict secrets strictly to deployment steps rather than entire job environments, isolate cache keys between privileged and unprivileged branches, and audit custom build tools to ensure they do not dump process environments into cached workspace paths.