CVE-2025-30066tj-actions/changed-files tags repointed to dump CI secrets into logs
What broke
On March 14 and 15, 2025, an attacker modified version tags of the tj-actions/changed-files GitHub Action, v1 through v45.0.7, so they pointed at a malicious commit (0e58ed8). Any workflow that referenced the action by tag ran that code. It downloaded a Python script that read the memory of the GitHub Actions Runner Worker process, base64-encoded the secrets it found, and printed them into the build log. On a public repository those logs are readable by anyone. NVD scores it CVSS 3.1 8.6, and the CWE is CWE-506 (embedded malicious code). The GitHub advisory says more than 23,000 repositories used the action; v46.0.1 is the fixed release.
CISA added it to KEV on March 18, 2025 and listed what the logs could hold: AWS access keys, GitHub personal access tokens, npm tokens and private RSA keys. CISA also said the compromise was potentially enabled by an earlier compromise of reviewdog/action-setup@v1 (CVE-2025-30154).
Why it matters
No password or login was involved. The identities at risk were the pipeline's own credentials: every token and cloud key a workflow could read became readable by whoever watched the log. A CI job is a non-human identity with standing access to registries, clouds and source code, and it trusted a mutable tag to decide which code ran with those secrets in memory. This is the secrets in repositories and CI pattern at scale.
What to do
- Pin third-party actions to a full commit SHA, not a tag. Tags can be moved; a SHA cannot.
- Search workflow runs from March 14 and 15, 2025 for changed-files output, and decode any base64 blobs (the advisory gives the command).
- Replace long-lived cloud keys in CI with short-lived credentials through workload identity federation (GitHub OIDC to AWS, Azure or Google Cloud).
- Restrict outbound network access from runners so a step cannot fetch a script from an unexpected host.
After you patch
- Rotate every secret any affected workflow could read, not only the ones you find in logs. See secrets rotation.
- Review the audit trail of each rotated token for use between March 14, 2025 and the rotation date.
Sources
In the Identity Breach Database
Breaches in our database where this vulnerability was exploited.
- tj-actions/changed-files GitHub Action compromise leaks CI secrets 2025 · Supply chain
Related on Start with Identity
- BlogLiteLLM traces its poisoned release to an admin key leaked in May and never revoked
LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it r
- BlogPoisoned LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for under three hours
LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository
- BlogThe developer toolchain is now the busiest identity perimeter
A worm that wipes your home directory when you revoke its stolen token, about 1,900 hijacked GitHub accounts, a publishing trust bound to a reclaimable name, an
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- CVEN-able N-central auth bypass, incomplete patch of CVE-2026-18556
N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August
- CVEZimbra ZCS chained with CVE-2025-48700 to steal MFA backup codes
Zimbra Collaboration Suite, chained with CVE-2025-48700, was used to steal MFA backup codes and app passwords (CERT-UA UAC-0233). Added to CISA KEV in mid-March
Technique
This CVE is an instance of Secrets in repositories and CI. A credential committed to a config file or pasted into a pipeline variable travels with every clone, fork, and log line, and it keeps working for as long as nobody notices it left the vault.