Rust Miri Toolchain Patched to Prevent Sensitive CI Cache Leaks
Rust maintainers have patched a vulnerability in the Miri toolchain that exposed repository secrets to GitHub Actions caches, requiring users to update their toolchain, clear existing caches, and rotate all exposed credentials.
Rust maintainers patched a cache-exposure vulnerability in the Miri toolchain. The issue allowed sensitive repository secrets to leak into GitHub Actions CI caches during cargo miri runs. Attackers—including malicious pull request submitters—could potentially access these credentials.
To fix this, you need to upgrade to the Rust nightly toolchain released on September 22, 2026. The patch stops secrets from reaching the cache.
However, updating the toolchain isn't enough on its own. You also have to clear your existing CI caches to purge previously stored compromised data. Furthermore, you must rotate all secrets, including Personal Access Tokens, that were accessible to past cargo miri jobs before you applied the fix. If you skip rotation, those exposed credentials remain vulnerable inside older cached artifacts.