Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Cordyceps CI/CD flaws allow unauthenticated users to hijack workflows and compromise over 300 GitHub repositories.
Cybersecurity researchers have identified a critical CI/CD workflow vulnerability, dubbed Cordyceps, that allows unauthenticated users to hijack workflows and compromise open-source supply chains. The flaw affects over 300 high-impact GitHub repositories from major organizations like Microsoft, Google, and Apache, enabling code execution, credential theft, and downstream supply chain compromise. Novee Security discovered that weak CI/CD configurations grant excessive permissions to pull requests, which can be exploited by anonymous users to gain full control over repositories.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Cordyceps vulnerability highlights how weak CI/CD pipeline configurations can grant unauthenticated users the ability to execute arbitrary code and steal credentials within high-profile repositories. The root cause is excessive permissions assigned to pull request workflows, allowing anonymous contributors to trigger privileged pipeline actions without any authentication barrier. This matters enormously because compromised repositories from organizations like Microsoft, Google, and Apache can cascade malicious code downstream to millions of dependent projects and end users. Supply chain attacks of this nature are particularly dangerous as they abuse trusted build infrastructure, making detection difficult and the blast radius exceptionally wide.
What helps against this
How we list vendors
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.