RubyGems CDN Caching Bug Could Leak Legacy API Keys to Other Users

A Fastly CDN caching bug on RubyGems.org could serve one user's freshly issued API key to a different user signing in from the same edge node within an hour. The root cause: the gem client's default gzip Accept-Encoding header broke ETag generation, causing the server to fall back to a bare no-cache header without Vary: Authorization, which made Fastly cache and replay the same authenticated response. Gem clients older than v3.2.0 (released December 2020) are affected — still roughly 18% of sign-ins today, including the gem tool bundled with current macOS (Tahoe).

A leaked key could let an attacker act as the victim account: publish a new gem version, yank existing versions, add owners, or configure trusted publishers and webhooks. It could not rewrite already-published releases, nor change passwords, email, or MFA settings. Accounts with MFA enabled for API requests were protected against push, yank, and ownership changes even if their key leaked.

RubyGems maintainers found no evidence of malicious exploitation in their access logs, though those logs cover only a fraction of the roughly nine years the bug is believed to have existed. As a precaution, all legacy API keys have been revoked, affected users notified, and the issue assigned a CVSS 4.0 score of 7.2 (High). Engineers are advised to update gem clients, review gem ownership and trusted-publisher settings, and enable MFA for API requests.