Rust team warns that Miri can leave CI secrets in cached target directories
Miri stored environment variables in target/, which can expose secrets to pull requests when GitHub Actions caches are shared.
The Rust Security Response Team has published guidance about an issue in Miri, the tool for detecting undefined behavior. When run through cargo miri, it stored all environment variables in the target directory. If a CI job holds secrets as environment variables and caches target/, those secrets can end up in the cache.
The risk applies when pull request workflows can read a cache written by trusted runs. Someone who has already had a change merged could trigger CI on a new push, read the cached files, and then push another commit to hide the step. The team says it is not a vulnerability by itself, but becomes a problem together with this caching behavior.
The short-term fix makes Miri keep only a limited set of Cargo-related variables, leaving out Cargo token variables. The post says the release in the nightly of 2026-09-22 no longer has the problem. The team also scanned GitHub repositories, found one repository with the issue, and contacted the maintainers involved.
Projects that run cargo miri in CI should check whether the step has access to secrets and whether the cache is readable by pull requests. Possible fixes are disabling the cache for that job, limiting secrets to steps that do not call Miri, or pausing Miri. Clear the cache afterwards and consider rotating secrets that may have been exposed.