Poisoned Pipeline / Incidents / AS117
Miri writes env secrets into target/ readable from PR caches
Rust Security Response Team (21 Sep 2026): cargo miri stored all
environment variables under target/. Combined with GitHub Actions cache
(PRs can read caches written on main), a later PR can recover CI secrets
from the cache. Not a registry hijack — a tool+platform pairing. Short
term fix: Miri only preserves CARGO_* (except tokens) and OUT_DIR.
Nightly 2026-09-22.
Mapped techniques
- T0130 Harvest secrets from logs
- T0193 Sensitive information in environment variables
- T0162 Passwords in CI/CD logs
supply-chain cache readable secrets
Secrets persisted in cached target/ rather than logs, same class.
Miri dumped the full environment into the cache.
PR jobs could read the poisoned cache.