Rust team advises CI users to check Miri setups that cache the target directory with secrets present
Miri stored environment variables in target/, which can expose secrets when a public cache is shared with pull request builds.
The Rust Security Response Team has published guidance about an issue in Miri, the interpreter used to check Rust code for undefined behaviour. When cargo miri runs, it saved every environment variable into the target directory. If a CI job holds secrets in its environment and also caches that directory, the secrets can end up in the cache.
The risk appears on GitHub Actions setups where pull request builds can read caches written by builds on the main branch. A contributor who has already landed a change could, in principle, extract values from the cached directory. The team says a scan of public repositories found one affected project and seven that looked safe but should be careful, and it has contacted those maintainers.
The short-term fix makes Miri keep only CARGO_ variables (excluding CARGO token variables) and OUT_DIR. The team notes the patch may not yet be in every nightly, and that the release in the 2026-09-22 nightly no longer has the problem.
Developers who run cargo miri in CI should check whether the step can see secrets, whether the target directory is cached, and whether pull requests can read that cache. Suggested mitigations are disabling the cache for that job, limiting secrets to steps that do not call Miri, or pausing Miri. After that, clear the cache and consider rotating any secrets that may have been stored.
Sources
Verified Oct 24, 2026 (official source). rustsecuritycigithub-actions