Rust warns that cached Miri output can expose CI secrets

Miri, Rust’s tool for detecting undefined behavior, stored environment variables in the target directory. When a GitHub Actions job runs Miri with secrets available and caches that directory, pull-request jobs may be able to read those secrets from the cache. The Rust security team describes the affected combination and a patch that limits which variables Miri preserves.

Rust Project · Sep 21, 2026

Why it matters

Check this if your Rust CI combines Miri, environment secrets and shared build caches.

More context

Review those four conditions together. The advisory recommends separating secrets from Miri steps or disabling the affected cache, clearing existing caches, and considering rotation of exposed secrets. It announces a fix for the September 22 nightly.

Keep in mind

This does not mean every Miri workflow leaked secrets. Updating alone does not remove old cached data; 1min has not inspected your CI or independently verified the nightly fix.

Original read