For about eight days in September 2021, the hosted continuous integration service Travis CI exposed the secret environment variables of public open-source projects to anyone who forked a repository and opened a pull request. Normally those secrets, such as signing keys, access credentials and API tokens, are withheld from builds triggered by forks. According to the CVE record, CVE-2021-41077, builds from 3 to 10 September could reveal them "to an unauthorized actor who forked a public repository" and printed files during a build. Ethereum developer Felix Lange found the leak on 7 September and Travis CI fixed it on 10 September, according to The Register. Travis published a short security bulletin on 13 September asking users to rotate secrets and saying it had found no evidence that the exposure had been exploited. Ethereum's Péter Szilágyi criticised the quiet fix and the lack of a post-mortem. No misuse of an exposed secret has been confirmed.
Key takeaways
- CVE-2021-41077 let anyone who forked a public repository on Travis CI read that project's secret environment variables in builds from 3 to 10 September 2021, according to NVD.
- The exposed secrets were the project's own machine credentials: signing keys, access credentials and API tokens used by CI builds.
- Travis CI said it "found no evidence of unauthorized parties leveraging the potential exposure"; no affected project count has been published.
- Felix Lange of Ethereum reported the leak on 7 September; Travis fixed it on 10 September and issued a bulletin on 13 September that did not name the CVE, according to The Register.
- The identity lesson: secrets handed to a build are only as safe as the CI platform's rules about who can trigger that build, so they must be scoped, short-lived and rotated after any exposure window.
At a glance
| Organisation | Travis CI and the public open-source projects that stored secrets in it |
|---|---|
| When | Builds from 3 to 10 September 2021; disclosed by Travis CI on 13 September 2021; CVE published 14 September 2021 |
| Attacker | None known. Found by Ethereum developer Felix Lange |
| Entry point | A flaw in Travis CI's build activation that passed upstream secrets to builds from forked repositories |
| Identities abused | Secret environment variables of public projects, including signing keys, access credentials and API tokens |
| Impact | Secrets of public projects exposed for about eight days; Travis CI found no evidence of misuse and no misuse has been confirmed |
| Category | NHI. Incident class: exposure, no confirmed misuse (CI secrets readable from forked pull requests) |
What happened
Travis CI runs automated builds and tests for software projects, and in 2021 it was widely used by open-source projects. The Register noted that, as of 2019, it was used in more than 932,977 open-source projects. Projects store secrets in Travis as encrypted environment variables so that builds can sign releases, publish packages or call cloud services. Because anyone can fork a public repository and open a pull request, Travis's documentation says those secrets are withheld from builds triggered by pull requests from forks, according to The Register.
In early September 2021 that rule failed. The NVD record for CVE-2021-41077 describes a flaw in the activation process for certain builds from 3 to 10 September that caused secret data, such as signing keys, access credentials and API tokens, to be revealed to someone who forked a public repository and printed files during a build. NIST scores it 7.5 (High). According to The Register, Ethereum developer Felix Lange identified the secret leakage on 7 September, and Travis fixed the flaw on 10 September.
Travis's public response was brief. Its bulletin of Monday 13 September said the issue affected only public repositories and that "To date, we found no evidence of unauthorized parties leveraging the potential exposure." It added: "As a reminder, cycling your secrets is something that all users should do on a regular basis." The bulletin also stated, "We updated our servers on Sept 3rd to resolve this potential issue," which does not match NVD and press reports that the exposure ran from 3 to 10 September. The Register pointed out that the bulletin did not mention the CVE or describe the issue as a vulnerability, and that Travis did not answer its questions.
Ethereum team lead Péter Szilágyi was openly critical. "After 3 days of pressure from multiple projects, @travisci silently patched the issue on the 10th," he wrote, as quoted by The Register. "No analysis, no security report, no post mortem, not warning any of their users that their secrets might have been stolen." The Hacker News reported his warning that anyone could have used the secrets to move laterally into thousands of organisations. That is a statement of what was possible; no source has reported a secret actually taken through this flaw.
Timeline
| Date | Event |
|---|---|
| 3 September 2021 | Start of the build window in which secrets could be exposed to forks, according to NVD. |
| 7 September 2021 | Felix Lange of Ethereum identifies the secret leakage, according to The Register. |
| 10 September 2021 | Travis CI fixes the flaw. |
| 13 September 2021 | Travis CI publishes a security bulletin recommending secret rotation and reporting no evidence of misuse. |
| 14 September 2021 | CVE-2021-41077 is published in NVD; Péter Szilágyi criticises the silent patch on Twitter (posts cited in the NVD record). |
| 15 September 2021 | The Register reports the flaw and the criticism; The Hacker News follows on 16 September. |
How it happened: the identity attack path
- Secrets stored in CI. Public projects kept machine credentials such as signing keys, registry tokens and cloud keys as Travis environment variables for their builds.
- Fork protection broke. A flaw in Travis's build activation, introduced around 3 September 2021, passed those variables to builds triggered by pull requests from forks.
- Anyone could trigger a build. Forking a public repository and opening a pull request was enough to start a build with the upstream project's secrets present.
- Secrets readable in output. A pull request that printed files or environment data during the build could have revealed the secrets in build logs.
- Fix and rotation advice. Travis fixed the flaw on 10 September and advised users to rotate secrets; no misuse has been confirmed.
Impact
- Exposed: secret environment variables of public projects that ran builds on Travis CI between 3 and 10 September 2021, including signing keys, access credentials and API tokens. No count of affected projects has been published.
- Misuse: none confirmed. Travis said it found no evidence of unauthorised parties using the exposure.
- Potential: stolen signing keys or publishing tokens could have let attackers release tampered software under trusted project names, and cloud keys could have opened projects' infrastructure.
- Trust: the quiet fix and short bulletin led maintainers such as Szilágyi to urge projects to reconsider the platform.
What this means for NHI governance
Every secret in a CI system is a non-human identity acting for the project: a signing key that says "this release is ours", a token that can publish to a registry, a cloud key that can deploy. Those identities are only as protected as the rules about which builds receive them. When Travis's fork rule broke, the secrets of public projects were exposed to anyone willing to open a pull request, and their owners could not tell from their own logs whether anyone had.
That is why exposure windows have to be handled as compromises. Projects should rotate every secret that was present during the window, prefer short-lived credentials such as OIDC federation over stored keys, and give each pipeline only what the specific job needs. The same CI platform reappeared in the GitHub OAuth token breach of 2022, when stolen Travis CI and Heroku OAuth tokens were used against private repositories. Our CI/CD Pipeline Identity Security Guide and Secrets Management Guide cover these controls.
Recommendations
- Revoke and rotate every secret present during an exposure window. Do not wait for evidence of misuse; replace signing keys, tokens and cloud keys from a clean system. See the Leaked Credential Response Playbook.
- Replace stored CI secrets with short-lived federated credentials. Use OIDC to obtain cloud and registry access per job, so there is nothing long-lived to leak. See our CI/CD Pipeline Identity Security Guide.
- Keep secrets out of builds triggered by untrusted code. Run fork pull requests in a separate, secret-free pipeline and require maintainer approval before privileged jobs run.
- Scope each secret to one job and one purpose. A test job should never hold a release signing key. See our Secrets Management Guide.
- Watch for use of CI credentials from unexpected places. Registry, cloud and signing logs can show a token used outside the pipeline.
- Hold CI vendors to clear disclosure. Ask providers how they will notify you of secret exposure, with dates and affected scope. See our Third-Party Access Guide.
Frequently asked questions
What is CVE-2021-41077?
CVE-2021-41077 is a Travis CI flaw in which builds from 3 to 10 September 2021 could reveal a public project's secret data, such as signing keys, access credentials and API tokens, to anyone who forked the repository and printed files during a build. NIST rates it 7.5 (High).
Were Travis CI secrets actually stolen?
No theft has been confirmed. Travis CI said it found no evidence of unauthorised parties using the exposure, but project owners could not easily verify that themselves, so all secrets used in public builds during the window should have been rotated.
Were private Travis CI repositories affected?
Travis CI's bulletin says the issue applied only to public repositories, not private ones. It still recommended that both public and private repository customers rotate their secrets regularly.
Related NHI Mgmt Group resources
GitHub OAuth Token Breach 2022 · Codecov Breach 2021 · CircleCI Breach 2023 · CI/CD Pipeline Identity Security Guide · Secrets Management Guide
How NHI Mgmt Group can help
CI/CD platforms hold some of the most powerful credentials an organisation has. We help teams inventory pipeline secrets, move to short-lived federated credentials and build response plans for when a CI provider reports an exposure. See our NHI and AI agent security training.
References
- Travis CI Community: Security Bulletin (13 September 2021)
- NIST NVD: CVE-2021-41077 (14 September 2021)
- The Register: Travis CI quietly fixed a bug that exposed secret keys (15 September 2021)
- The Hacker News: Travis CI Flaw Exposes Secrets of Thousands of Open Source Projects (16 September 2021)