GitHub Actions Leaks Secrets When Miri Compiler Output Is Cached
A security researcher reported that GitHub Actions workflows can expose sensitive secrets if the build cache contains output from the Miri interpreter.
Key points
- GitHub Actions workflows may leak secrets when caching Miri interpreter output.
- The issue was reported by user Beaconamber on the r/netsec subreddit.
- Cached build artifacts can inadvertently store sensitive environment variables.
A security researcher identified a configuration flaw in GitHub Actions that allows sensitive secrets to be leaked when the build system caches output from the Miri Rust interpreter. The finding was submitted by user Beaconamber to the r/netsec subreddit, highlighting a specific scenario where standard caching practices compromise security boundaries within CI/CD pipelines.
The vulnerability arises when developers use the Miri interpreter for running Rust code during continuous integration tests. According to the report, if the output generated by Miri is included in the cached build artifacts, any secrets injected into the environment during the workflow execution can persist in those caches. This creates a persistent risk because cached data is often stored externally and may be accessible to other processes or users with repository access.
Context and Background
Miri is an experimental interpreter for Rust that allows developers to detect undefined behavior in their code without running it on actual hardware. It is commonly used in development environments to catch memory safety issues early. When integrated into GitHub Actions, Miri runs within the same environment as the rest of the build process, meaning it has access to all environment variables defined in the workflow, including those marked as secrets.
The core issue is not a bug in Miri itself, but rather how the output is handled by the caching mechanism in GitHub Actions. Standard caching strategies often store entire directories or specific output files to speed up subsequent builds. If the configuration does not explicitly exclude sensitive data from the cache, secrets can be written to disk as part of the Miri output logs or temporary files. These cached files remain available for future workflow runs, potentially exposing the secrets to anyone who can access the cache or view the build logs.
Who Is Affected
Developers using Rust projects on GitHub are primarily affected by this issue, specifically those who have configured their workflows to use Miri for testing. Any repository that employs caching to optimize build times for Miri-based tests is at risk if the cache configuration includes output directories that may contain sensitive information. The risk is heightened for organizations that store high-value secrets, such as API keys or database credentials, in their GitHub Actions environment variables.
The exposure is not limited to public repositories. Private repositories are equally vulnerable because the cache storage mechanism does not inherently sanitize sensitive data before storage. According to the report, the leakage occurs due to the interaction between the interpreter’s output and the caching service, rather than a flaw in GitHub’s secret management system itself. This means that teams relying on default or overly broad caching configurations for their Rust builds are exposed to this specific attack vector.
What should you do?
Security teams should audit their GitHub Actions workflows to ensure that caching configurations do not include directories or files that may contain environment variables. Reviewing the cache key and path settings is essential to prevent accidental inclusion of sensitive data. Organizations should also monitor their build logs for any signs of unexpected data exposure and restrict access to cached artifacts.
What to do and how to stay safe: GitHub Actions
- Review GitHub Actions workflow files to ensure caching paths exclude directories containing Miri output or temporary files.
- Audit environment variable usage in Rust-based workflows to minimize the number of secrets available during interpretation steps.
- Monitor cache contents and build logs for any inadvertent exposure of sensitive data or API keys.
- Implement stricter access controls on cached artifacts to limit who can view or retrieve stored build data.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What causes secrets to leak in this scenario?
Secrets leak when the output from the Miri interpreter, which may contain environment variables, is stored in the GitHub Actions build cache.
Who reported this issue?
The issue was reported by user Beaconamber on the r/netsec subreddit.
Does this affect all GitHub Actions users?
It primarily affects users who run the Miri Rust interpreter in their workflows and cache the resulting output.
