Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking
CI/CD vulnerabilities allow unauthenticated attackers to hijack developer workflows and control millions of
A new class of vulnerabilities, dubbed Cordyceps, has been discovered in CI/CD workflows that could allow unauthenticated attackers to hijack developer workflows and gain full control over millions of open-source repositories. These flaws, found in GitHub Actions YAML files, can lead to command injection, artifact poisoning, and credential exfiltration, impacting build tooling from major vendors like Microsoft, Google, and Apache. Novee, the cybersecurity firm that identified the issues, warns that these vulnerabilities are often overlooked by traditional scanners because they exploit the composition of workflows rather than individual components.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Cordyceps vulnerabilities expose a critical blind spot in how organizations secure their software development pipelines: GitHub Actions YAML files can be composed in ways that introduce command injection, artifact poisoning, and credential exfiltration risks that traditional scanners miss entirely. Because these flaws emerge from the *interaction* between workflow components rather than any single vulnerable file, they evade conventional static analysis tools and remain undetected in millions of repositories. The downstream impact is severe — a compromised CI/CD pipeline gives attackers a trusted insertion point into the software supply chain, potentially affecting every user of the resulting software artifacts. This highlights how misconfigured automation infrastructure, not just application code, has become a primary attack surface in modern development environments.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.