It's been almost a week since this dropped, but it's too good an example to skip: another reminder that the automation we trust to build and ship our software can just as easily be turned against us.
What happened
Researchers at Novee Security disclosed a class of CI/CD misconfiguration they've nicknamed Cordyceps, after scanning roughly 30,000 high-impact GitHub repositories. Over 300 of them turned out to be fully exploitable, including repos belonging to Microsoft, Google, Cloudflare, Apache, and the Python Software Foundation.
The scary part: no special access is required. A free GitHub account and a crafted pull request or comment is enough to forge approvals, execute code on a company's own build infrastructure, or steal long-lived credentials.
The root cause
The flaw isn't a bug in any single tool, it's a trust boundary problem. Many CI/CD workflows grant untrusted pull requests more privilege than they should, letting attacker-controlled input (a branch name, a PR comment, a forked repo) trigger privileged automation. Each individual piece works exactly as designed; the vulnerability only emerges in how they're composed together.
- Microsoft Azure Sentinel: a PR comment could run anonymous code on Microsoft's CI and steal a non-expiring GitHub App key.
- Google's ADK Samples: a PR could execute attacker code to gain full control of a Google Cloud repository.
- Apache Doris: zero-click attacks let a single PR comment exfiltrate hard-coded credentials or a token with full write access.
- Cloudflare Workers SDK: a crafted branch name alone could execute arbitrary commands on Cloudflare's CI runners.
- Python's Black: any outside contributor's PR could steal an automation token capable of approving future PRs.
Why it echoes past GitHub Actions abuse
This lands in the same family as the GitHub Actions supply-chain incidents from earlier this year, where compromised or overly-permissive workflows were used to inject malicious code and harvest secrets across dependent projects. The pattern keeps repeating: CI/CD systems are granted broad, often invisible trust, and attackers only need to find the one workflow that mishandles untrusted input.
Researchers also flagged a newer wrinkle, the rise of AI-assisted and agentic coding means these misconfigurations can be reproduced and spread across repositories faster than before, effectively "infecting" projects at scale.
The takeaway
Following responsible disclosure, Microsoft and Google confirmed impact, while Cloudflare, Python, and Apache rolled out fixes and hardening. For everyone else, it's a solid nudge to audit workflow permissions, avoid triggering privileged jobs from untrusted PR content, and treat CI/CD pipelines as the high-value target they clearly are.
Source: The Hacker News, "Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks"