GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk

As cited

Copy frozen at 2026-09-17 01:51 UTC (site build).

cloud saas

GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk

GitHub introduced cache-mode, a new setting for GitHub Actions that restricts how workflows and jobs can access the shared Actions cache to mitigate cache poisoning attacks. The feature supports four values (read, write, write-only, and none) that can be set at the workflow or job level, with enforcement at the cache service and inheritance through reusable workflows. The setting addresses attacks like the 2024 Ultralytics compromise and May 2026 TanStack incident, where attackers wrote malicious artifacts to shared caches that trusted workflows later restored and executed.

Why it matters: Teams using GitHub Actions should configure cache-mode to enforce least-privilege access, especially for untrusted events like pull requests and artificial intelligence (AI) agent workflows, to prevent cache poisoning attacks that can execute malicious code with the workflow's permissions and secrets.

Source published

2026-09-16 19:36 UTC

First seen by Cybersecurity Tracker

2026-09-16 22:11 UTC