Cordyceps: Systemic Cross-Workflow Privilege-Escalation Supply-Chain Flaw in GitHub Actions CI/CD Pipelines (Microsoft Azure Sentinel, Google ADK, Apache Doris, Cloudflare Workers SDK, PSF Black)
Cordyceps: Systemic Cross-Workflow Privilege-Escalation (TL-2026-0928), also tracked as Cordyceps, is a critical-severity supply-chain compromise, first published 2026-06-23. It has no confirmed attribution, affects GitHub GitHub Actions (CI/CD workflows), maps to 17 MITRE ATT&CK techniques (T1059.004, T1078, T1078.004), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0928
- Threat ID
- TL-2026-0928
- Also known as
- Cordyceps
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-23
- Last reviewed
- 2026-06-23
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, open-source, cloud, government
- Target regions
- Global, North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Cordyceps: Systemic Cross-Workflow Privilege-Escalation
Malware and tooling: GitHub Actions, Wrangler CLI
Novee Security disclosed 'Cordyceps', a systemic class of insecure GitHub Actions workflow compositions that lets anyone with a free GitHub account chain command injection, broken authentication logic, artifact poisoning, and cross-workflow privilege escalation to seize full control of repositories, CI/CD pipelines, and downstream build artifacts. A scan of ~30,000 high-impact repositories flagged 654 instances and confirmed 300+ fully exploitable chains, including at Microsoft (Azure Sentinel), Google (AI Agent Development Kit), Apache (Doris), Cloudflare (Workers SDK), and the Python Software Foundation (Black) — all since fixed.
How Cordyceps: Systemic Cross-Workflow Privilege-Escalation works
Cordyceps is not a single CVE but a systemic class of insecure CI/CD workflow compositions in GitHub Actions, named after the parasitic fungus that hijacks its host. Disclosed by research firm Novee Security on 2026-06-23, it exploits the fact that GitHub Actions treats YAML workflow files as configuration rather than security-sensitive code, allowing untrusted attacker-controlled inputs — pull request titles, branch names, and comment bodies — to cross trust boundaries from low-privilege, attacker-triggerable workflows into high-privilege workflows that hold secrets and authenticate to cloud environments.
The core pattern is a multi-step attack chain: an untrusted pull request (or even a comment on one) triggers a low-privilege workflow whose output flows into a high-privilege workflow, which then authenticates to a cloud environment or signs/publishes artifacts. Each individual step appears normal, but their composition creates a clear path to full control. The building blocks Novee identified are (1) command injection via unsanitized untrusted inputs interpolated into run steps, (2) broken authentication logic where trigger context is mis-trusted, (3) artifact- and cache-poisoning chains where a low-privilege job's output is consumed by a privileged job, and (4) cross-workflow privilege escalation where data tainted by an untrusted event reaches a context holding long-lived credentials.
Because the risk lives in how multiple workflows interact — not in any single file — conventional static and dynamic scanners that inspect one file for known-bad patterns miss it entirely. Novee scanned roughly 30,000 high-impact repositories, flagged 654 instances in a single scan, and confirmed over 300 repositories as fully exploitable across the npm, PyPI, crates, and Go ecosystems. Anyone with a free GitHub account can exploit affected chains without special privileges or organization membership.
Confirmed exploitable chains at named organizations: at Microsoft's Azure Sentinel, a single comment on a pull request was enough for an attacker to execute code and steal a non-expiring GitHub App private key; at Google's AI Agent Development Kit (ADK), a single pull request could hand an attacker the highest Google Cloud (owner-level) role; at Apache Doris, two zero-click attack paths were confirmed, both leading to credential theft; at Cloudflare's Workers SDK, the chain enabled unauthorized command execution via the Wrangler CLI; and at the Python Software Foundation's Black formatter (130M+ monthly downloads), a malicious pull request could steal an automation token and approve pull requests as the project bot, potentially reaching millions of downstream users. Novee notes the problem is being amplified as developers increasingly use AI tools to generate CI/CD configuration files, reproducing the same insecure workflow patterns at scale. All disclosed instances were reported and patched by the affected organizations.
MITRE ATT&CK techniques used in TL-2026-0928
Execution
T1059.004 Unix Shell; T1204 User Execution
Initial Access
T1078 Valid Accounts; T1078.004 Cloud Accounts; T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain
Privilege Escalation
T1078.004 Cloud Accounts; T1548 Abuse Elevation Control Mechanism
Persistence
T1098.001 Additional Cloud Credentials; T1098.003 Additional Cloud Roles
Defense Evasion
T1127 Trusted Developer Utilities Proxy Execution
Collection
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Impact
T1565.001 Stored Data Manipulation
Discovery
T1580 Cloud Infrastructure Discovery
Resource Development
Affected products and versions in Cordyceps: Systemic Cross-Workflow Privilege-Escalation
- GitHub — GitHub Actions (CI/CD workflows)
Vulnerable versions: Insecure workflow compositions using pull_request_target / workflow_run / issue_comment triggers
Fixed in: Workflow-level remediation; no platform CVE - Microsoft — Azure Sentinel (content pipeline)
Vulnerable versions: Workflow exposed non-expiring GitHub App key via PR comment
Fixed in: Reported and patched - Google — AI Agent Development Kit (ADK)
Vulnerable versions: Workflow granted owner-level Google Cloud role from a single PR
Fixed in: Reported and patched - Apache — Doris
Vulnerable versions: Two zero-click credential-theft attack paths
Fixed in: Reported and patched - Cloudflare — Workers SDK (Wrangler CLI)
Vulnerable versions: Unauthorized command execution via Wrangler in CI
Fixed in: Reported and patched - Python Software Foundation — Black (code formatter, 130M+ monthly downloads)
Vulnerable versions: Automation token theft; bot PR approval via malicious PR
Fixed in: Reported and patched
Remediation for Cordyceps: Systemic Cross-Workflow Privilege-Escalation
Patches
- Apply upstream fixes shipped by Microsoft (Azure Sentinel), Google (AI Agent Development Kit), Apache (Doris), Cloudflare (Workers SDK), and the Python Software Foundation (Black)
Immediate actions
- Audit all GitHub Actions workflows for pull_request_target, workflow_run, and issue_comment triggers that run on untrusted code or consume untrusted inputs
- Stop interpolating untrusted inputs (PR titles, branch names, comment bodies, ${{ github.event.* }}) directly into run: steps; pass them through environment variables and quote them
- Rotate any long-lived secrets that may have been exposed to attacker-triggerable workflows (GitHub App private keys, cloud credentials, automation/publish tokens)
Workarounds
- Require maintainer approval before running workflows on pull requests from first-time/forked contributors
- Prefer the pull_request trigger (no secret access) over pull_request_target for untrusted PR validation
- Pin third-party actions to full commit SHAs and scope OIDC cloud federation to specific branches/environments
Longer-term hardening
- Treat workflow code with the same rigor as application code and conduct cross-workflow trust-boundary audits
- Enforce least privilege on GITHUB_TOKEN (set permissions: read-all by default; grant write scopes per-job only where required)
- Isolate untrusted workflows from secrets so low-privilege jobs cannot pass tainted output into privileged jobs
- Adopt CI/CD security scanning that analyzes cross-workflow data flows rather than single-file pattern matching
- Add end-to-end tests that simulate malicious pull requests to validate trust boundaries before merge
Weaknesses (CWE) in Cordyceps: Systemic Cross-Workflow Privilege-Escalation
CWE-94, CWE-77, CWE-78, CWE-269, CWE-913, CWE-829, CWE-345, CWE-862, CWE-863, CWE-668
Timeline of Cordyceps: Systemic Cross-Workflow Privilege-Escalation
- Coverage published across Cyber Security News, Hackread, Dark Reading, GBHackers, and Cyberpress.
- All disclosed instances were reported to and patched by the affected organizations prior to publication.
- Novee warned the problem is amplified as developers increasingly use AI tools to generate CI/CD configuration, reproducing the same insecure workflow patterns at scale.
- At the Python Software Foundation's Black formatter (130M+ monthly downloads), a malicious pull request could steal an automation token and approve PRs as the project bot, reaching potentially millions of downstream users.
- At Apache Doris two zero-click credential-theft attack paths were confirmed, and at Cloudflare's Workers SDK the chain enabled unauthorized command execution via the Wrangler CLI.
- At Google's AI Agent Development Kit (ADK), a single pull request could grant an attacker the highest (owner-level) Google Cloud role.
- At Microsoft's Azure Sentinel, a single comment on a pull request was shown sufficient to execute code and steal a non-expiring GitHub App private key.
- Over 300 repositories were confirmed fully exploitable across the npm, PyPI, crates, and Go ecosystems, exploitable by anyone with a free GitHub account.
- Novee reported scanning ~30,000 high-impact repositories, flagging 654 instances in a single scan.
- Novee characterized the four reusable building blocks of a Cordyceps chain: command injection via untrusted inputs, broken authentication/trigger-context logic, artifact- and cache-poisoning, and cross-workflow privilege escalation.
- Novee Security publicly disclosed the 'Cordyceps' class of insecure GitHub Actions workflow compositions, named after the parasitic fungus that hijacks its host.
Sources cited for Cordyceps: Systemic Cross-Workflow Privilege-Escalation
- Cordyceps Supply Chain Flaw Impacting Code Repositories at Thousands of Organizations
- 'Cordyceps' CI/CD Flaw Exposes Microsoft, Google, Apache Repos to Pipeline Hijacking
- 'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows
- Cordyceps Supply Chain Vulnerability Impacting Code Repositories at Thousands of Organizations
- Cordyceps Supply Chain Flaw Impacts Code Repositories Across Thousands of Organizations
- GitHub Security Lab: Keeping your GitHub Actions and workflows secure — Untrusted input (pull_request_target)
- GitHub Docs: Security hardening for GitHub Actions
Threats related to Cordyceps: Systemic Cross-Workflow Privilege-Escalation
- Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub Repositories (Microsoft, Google, Apache, Cloudflare, PSF) to Supply-Chain Attacks
- Amazon Q Developer Extension Trust-Boundary & Symlink Flaws (CVE-2026-12957, CVE-2026-12958) Auto-Execute Malicious MCP Configs
- Personal GitHub Repositories Are a Major Blind Spot for Corporate Secret Leaks (Wiz Research)
Detection coverage for TL-2026-0928
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0928 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.