Cordyceps: Systemic Cross-Workflow Privilege-Escalation Supply-Chain Flaw in GitHub Actions CI/CD Pipelines (Microsoft Azure Sentinel, Google ADK, Apache Doris, Cloudflare Workers SDK, PSF Black) — Threadlinqs Intelligence
As of 2026-06-24, Cordyceps: Systemic Cross-Workflow Privilege-Escalation Supply-Chain Flaw in GitHub Actions CI/CD Pipelines (Microsoft Azure Sentinel, Google ADK, Apache Doris, Cloudflare Workers SDK, PSF Black) is a critical-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0928 · Severity: CRITICAL · Status: PATCHED · Category: SUPPLY_CHAIN
Novee Security disclosed 'Cordyceps', a systemic class of insecure GitHub Actions workflow compositions that lets anyone with a free GitHub account chain command injection, broken authentication
Cordyceps is not a single CVE but a systemic class of insecure CI/CD workflow compositions in GitHub Actions, named after the parasitic fungus that hijacks its host. Disclosed by research firm Novee Security on 2026-06-23, it exploits the fact that GitHub Actions treats YAML workflow files as configuration rather than security-sensitive code, allowing untrusted attacker-controlled inputs — pull request titles, branch names, and comment bodies — to cross trust boundaries from low-privilege, attacker-triggerable workflows into high-privilege workflows that hold secrets and authenticate to cloud environments.
The core pattern is a multi-step attack chain: an untrusted pull request (or even a comment on one) triggers a low-privilege workflow whose output flows into a high-privilege workflow, which then authenticates to a cloud environment or signs/publishes artifacts. Each individual step appears normal, but their composition creates a clear path to full control. The building blocks Novee identified are (1) command injection via unsanitized untrusted inputs interpolated into run steps, (2) broken authentication logic where trigger context is mis-trusted, (3) artifact- and cache-poisoning chains where a low-privilege job's output is consumed by a privileged job, and (4) cross-workflow privilege escalation where data tainted by an untrusted event reaches a context holding long-lived credentials.
Because the risk lives in how multiple workflows interact — not in any single file — conventional static and dynamic scanners that inspect one file for known-bad patterns miss it entirely. Novee scanned roughly 30,000 high-impact repositories, flagged 654 instances in a single scan, and confirmed over 300 repositories as fully exploitable across the npm, PyPI, crates, and Go ecosystems. Anyone with a free GitHub account can exploit affected chains without special privileges or organization membership.
Confirmed exploitable chains at named organizations: at Microsoft's Azure Sentinel, a single comment on a pull request was enough for an attacker to execute code and steal a non-expiring GitHub App private key; at Google's AI Agent Development Kit (ADK), a single pull request could hand an attacker the highest Google Cloud (owner-level) role; at Apache Doris, two zero-click attack paths were confirmed, both leading to credential theft; at Cloudflare's Workers SDK, the chain enabled unauthorized command execution via the Wrangler CLI; and at the Python Software Foundation's Black formatter (130M+ monthly downloads), a malicious pull request could steal an automation token and approve pull requests as the project bot, potentially reaching millions of downstream users. Novee notes the problem is being amplified as developers increasingly use AI tools to generate CI/CD configuration files, reproducing the same insecure workflow patterns at scale. All disclosed instances were reported and patched by the affected organizations.
Weaknesses (CWE)
CWE-94, CWE-77, CWE-78, CWE-269, CWE-913, CWE-829, CWE-345, CWE-862, CWE-863, CWE-668
Target sectors: technology, software-development, open-source, cloud, government
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1195.002, T1078, T1078.004, T1059.004, T1204, T1098.003, T1098.001, T1078.004, T1548
