GitHub Actions: Miri cache config error exposes secrets for CI/CD users
A configuration oversight in GitHub Actions allows cached Miri compiler data to leak sensitive secrets, creating a risk for repositories using this specific workflow setup.
Key points
- GitHub Actions workflows can inadvertently leak secrets when caching Miri compiler output.
- The issue stems from how cached data is handled rather than a core platform vulnerability.
- Users employing Miri with caching in their CI/CD pipelines are potentially exposed.
GitHub Actions users face a data exposure risk when caching Miri compiler output, according to a report shared on r/netsec. The issue allows sensitive secrets stored in the workflow environment to be written into cached files. These cached artifacts can then be accessed by subsequent workflow runs, potentially exposing credentials to unauthorized users or processes within the same repository.
How it unfolded
- A user identified the issue and submitted the findings to the r/netsec community.
- The report highlighted that caching Miri output creates a pathway for secret leakage.
- The community discussion focused on the configuration error rather than a platform bug.
Who is affected
Organizations using GitHub Actions for continuous integration and deployment are at risk if they utilize the Miri compiler. Specifically, any repository that configures its workflow to cache the output generated by Miri is vulnerable. The exposure occurs because the caching mechanism stores the raw output, which may contain environment variables holding secrets. This affects managed service providers and development teams who rely on these automated workflows for testing and building code.
Our take on the response
The incident highlights the importance of understanding how caching mechanisms interact with sensitive data in CI/CD pipelines. While not a zero-day exploit in the traditional sense, it represents a significant configuration risk. The fact that this was reported on a public forum suggests that awareness is spreading among security researchers. Organizations must review their workflow configurations to ensure that cached artifacts do not contain sensitive information.
Background: CI/CD pipeline vulnerabilities
Isolate the pipeline server immediately. Revoke all service account tokens and API keys. Stop all active builds to prevent further propagation. Audit recent deployments for unauthorized changes. Rotate credentials across all connected systems. Rebuild affected artifacts from known good source code to ensure integrity.
Read the full guide: CI/CD Pipeline Breach Response: Steps to Contain and Recover
What to do and how to stay safe: GitHub Actions
- Review GitHub Actions workflow files to identify any steps that cache compiler or tool output.
- Audit cached artifacts to ensure they do not contain sensitive environment variables or secrets.
- Restrict access to cached data by using appropriate permissions and scopes in your workflows.
- Monitor workflow logs for any unexpected data exposure or unauthorized access to cached files.
Step-by-step guide: How Smartphone Security Updates Work: The Hidden Chain
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this a vulnerability in GitHub's core code?
No, it is a configuration issue related to how caching is used with specific tools like Miri.
Which tool is involved in this leak?
The Miri compiler, when its output is cached within GitHub Actions workflows.
Where was this issue first reported?
It was submitted to the r/netsec subreddit by a user named Beaconamber.
