‘Cordyceps’ CI/CD Flaw Exposes Microsoft, Google, Apache Repos to Pipeline Hijacking
Cordyceps CI/CD flaw in GitHub Actions allows anonymous users to hijack builds and steal tokens.
Novee Security has discovered Cordyceps, a systemic CI/CD vulnerability in GitHub Actions workflows that allows unauthenticated users to poison builds and steal sensitive tokens. This flaw, which affects major projects from Microsoft, Google, and Apache, can lead to full administrative control over cloud networks by exploiting multi-step attack chains that bypass standard security scanners. The vulnerability is exacerbated by AI coding agents that perpetuate insecure configuration patterns.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Cordyceps vulnerability exploits insecure GitHub Actions workflow configurations, allowing unauthenticated attackers to inject malicious code into build pipelines and steal sensitive tokens — including those granting cloud administrative access. The flaw is systemic, meaning it stems not from a single bug but from widespread insecure patterns embedded across major projects from Microsoft, Google, and Apache. Critically, AI coding assistants are actively propagating these insecure configurations by learning from and reproducing flawed patterns at scale. This matters because a compromised CI/CD pipeline represents a full software supply chain breach, enabling attackers to tamper with software artifacts distributed to millions of downstream users. Standard security scanners are insufficient to detect these multi-step attack chains, leaving organizations with a dangerous blind spot.
What helps against this
How we list vendors
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.