[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYTgxKcdzBB1EE6XJ1rHTjfjvWO3zBqYvOmVPnIU-Wtc":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e55a6e8c-c419-46d8-8935-0d7c8d928d15","Cordyceps CI\u002FCD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks","cordyceps-ci-cd-flaws-expose-300-github-repositories-to-supply-chain-attacks-2b8355","Cybersecurity researchers have flagged a new class of CI\u002FCD workflow weakness that allows attackers to hijack workflows and compromise open-source supply chains. The \"critical exploitable pattern\" has been codenamed Cordyceps by Novee Security. The issue can allow full attacker control of repositories at dozens of the largest organizations worldwide, including Microsoft, Google, Apache, and","Cybersecurity researchers have identified a critical CI\u002FCD workflow vulnerability, dubbed Cordyceps, that allows unauthenticated users to hijack workflows and compromise open-source supply chains. The flaw affects over 300 high-impact GitHub repositories from major organizations like Microsoft, Google, and Apache, enabling code execution, credential theft, and downstream supply chain compromise. Novee Security discovered that weak CI\u002FCD configurations grant excessive permissions to pull requests, which can be exploited by anonymous users to gain full control over repositories.","Cordyceps CI\u002FCD flaws allow unauthenticated users to hijack workflows and compromise over 300 GitHub repositories.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fcordyceps-cicd-flaws-expose-300-github.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjl_D6QzBWfQRZAXbjo9RhhLXSedzJR2Q2sUQoQYnDxpC7yETzJgn3KnpT8CcoqlfXdqkcnTCNcEpR1QKphy77NvG_9PIO57hHNF27x8pBb1pLf_4n3A6pTBs3qXQMsz81rvzpGIOqHZn7VqvJoJoB98o7COHOxi5wfkQvxhL4LcOxBkziY4MLxVCEOljX8\u002Fs1600\u002F1000085115.jpg","2026-06-24T12:48:11+00:00","2026-06-24T14:00:32.432879+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"GitHub","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":22},"Google",{"name":26,"type":22},"Apache",{"name":28,"type":22},"Cloudflare",{"name":30,"type":19},"Azure Sentinel","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,26],{"controls":57,"vendors":141},[58,86,115],{"slug":59,"name":60,"problem":61,"products":62},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[63,70,78],{"vendor_slug":64,"vendor_name":21,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":87,"name":88,"problem":89,"products":90},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":116,"name":117,"problem":118,"products":119},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[120,128,133],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":129,"product_name":130,"url":131,"description":132},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[142,147,151,155],{"slug":143,"name":28,"logo_path":144,"roles":145},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[146],"affected",{"slug":148,"name":18,"logo_path":149,"roles":150},"github","\u002Fvendor-logos\u002Fgithub.png",[146],{"slug":152,"name":24,"logo_path":153,"roles":154},"google","\u002Fvendor-logos\u002Fgoogle.png",[146],{"slug":64,"name":21,"logo_path":65,"roles":156},[146],{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":173},"cicd-misconfigurations-enable-supply-chain-hijacking-across-300-github-repos","CI\u002FCD Misconfigurations Enable Supply Chain Hijacking Across 300+ GitHub Repos","The Cordyceps vulnerability highlights how weak CI\u002FCD pipeline configurations can grant unauthenticated users the ability to execute arbitrary code and steal credentials within high-profile repositories. The root cause is excessive permissions assigned to pull request workflows, allowing anonymous contributors to trigger privileged pipeline actions without any authentication barrier. This matters enormously because compromised repositories from organizations like Microsoft, Google, and Apache can cascade malicious code downstream to millions of dependent projects and end users. Supply chain attacks of this nature are particularly dangerous as they abuse trusted build infrastructure, making detection difficult and the blast radius exceptionally wide.",[162,163,164,165,166,167,168,169,170,171,172],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST AC-3: Access Enforcement","NIST AC-6: Least Privilege","NIST SA-12: Supply Chain Protection","NIST SI-3: Malicious Code Protection","SLSA Supply Chain Levels for Software Artifacts (Levels 2–4)","OpenSSF Scorecard: Token-Permissions and Dangerous-Workflow checks","OWASP CI\u002FCD Security Top 10: CICD-SEC-4 Poisoned Pipeline Execution",{}]