Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub Repositories (Microsoft, Google, Apache, Cloudflare, PSF) to Supply-Chain Attacks
Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub (TL-2026-1021), also tracked as Cordyceps, is a critical-severity supply-chain compromise, first published 2026-06-30. It has no confirmed attribution, affects Microsoft Azure Sentinel (GitHub repository CI/CD workflows), maps to 29 MITRE ATT&CK techniques (T1005, T1036, T1059), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-1021
- Threat ID
- TL-2026-1021
- Also known as
- Cordyceps
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-30
- Last reviewed
- 2026-06-30
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- software development, technology, cloud infrastructure, open source ecosystem
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub
Malware and tooling: GITHUB_TOKEN
Novee Security researcher Elad Meged codenamed "Cordyceps" a systemic class of GitHub Actions CI/CD misconfigurations — command injection, code injection, broken authorization, and cross-workflow privilege escalation — that let any free, unauthenticated GitHub account forge approvals, push code, or steal credentials. A scan of ~30,000 high-impact repositories flagged 654 candidates and confirmed 300+ as fully exploitable, including at Microsoft Azure Sentinel, Google's AI Agent Development Kit, Apache Doris, Cloudflare's Workers SDK, and the Python Software Foundation's Black.
How Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub works
Cordyceps is not a single CVE but a named research campaign describing a recurring, exploitable pattern in GitHub Actions CI/CD pipelines: workflows that grant pull-request-triggered jobs more trust and privilege than the PR's origin warrants. Novee Security enumerated four root vulnerability classes across the ~30,000 high-impact open-source repositories it scanned (npm, PyPI, crates.io, and Go ecosystems): (1) command injection, where attacker-controlled strings — PR titles, branch names, and PR/issue comment bodies — are interpolated unsanitized into `run:` shell steps (CWE-78); (2) code injection, where untrusted input is evaluated at runtime through GitHub Actions' JavaScript expression/templating engine, analogous to server-side template injection; (3) broken authorization, where existing permission checks contain logic bugs that silently fail open rather than being altogether absent; and (4) cross-workflow privilege escalation, where untrusted data flows from a low-privilege workflow into a high-privilege one via artifacts, job outputs, or the GITHUB_ENV/GITHUB_OUTPUT environment files, letting a benign-looking first-stage workflow smuggle a malicious payload into a second, privileged workflow that runs with repository secrets and a broadly-scoped GITHUB_TOKEN. This is a scaled, cross-organization instantiation of the long-documented 'pwn request' pattern (workflows triggered on `pull_request_target` or similar that check out and execute forked-PR code with base-repo privileges), which GitHub Security Lab and other researchers (e.g., Praetorian's 'Long Live the Pwn Request') have previously documented individually. Novee's contribution is treating it as a systemic, at-scale supply-chain risk: no org membership, write access, or paid account is required — a free GitHub account is sufficient to open a PR, push to a fork, rename a branch, or leave a comment that triggers the vulnerable automation. Confirmed impact spanned five flagship organizations. At Microsoft Azure Sentinel, PR comments triggered anonymous code execution on Microsoft's CI systems, exposing a non-expiring GitHub App key that grants persistent write access to security content later deployed to customers via Azure Marketplace. At Google's AI Agent Development Kit (adk-samples, 9,200+ stars), a single crafted pull request executed attacker code inside Google Cloud CI, escalating to `roles/owner` — the highest possible GCP IAM permission. At Apache Doris, two independent chains were validated: PR comments exfiltrating hardcoded CI credentials, and a forked-PR path stealing tokens scoped to full write across actions, contents, packages, and pages. At Cloudflare's Workers SDK (Wrangler CLI), maliciously crafted branch names achieved arbitrary command execution on CI runners (code execution confirmed; no production secret escalation identified at that entry point). At the Python Software Foundation's Black (130M+ monthly installs), a PR from any account could steal the project's automation bot token, which itself carried PR-approval and protected-branch push authority, with a secondary Docker Hub credential exposure risk. Novee validated end-to-end exploitation (not just theoretical trust-boundary gaps) across a wide attack-surface matrix: publishing malicious packages to npm, PyPI, crates.io, Docker Hub/GHCR, and Helm; direct pushes to protected branches; forging CI status checks to bypass merge gates; theft of cloud credentials (AWS, GCP, Netlify); persistent compromise of self-hosted runners; and bot impersonation/social engineering. The researchers note traditional SAST/DAST/AST tooling structurally cannot find this class of bug because it requires reasoning across multiple workflow files and their differing trust levels — exactly the kind of cross-file, intent-aware analysis static scanners are not built for. Cloudflare, the Python Software Foundation, and Apache applied hardening fixes after disclosure; Microsoft and Google confirmed impact. Novee separately flags that AI-assisted ('agentic') coding threatens to reproduce these same insecure CI/CD patterns at even greater scale and speed across the open-source ecosystem.
MITRE ATT&CK techniques used in TL-2026-1021
Collection
T1005 Data from Local System; T1074 Data Staged
Defense Evasion
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1059.007 JavaScript
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1078.004 Cloud Accounts; T1548 Abuse Elevation Control Mechanism
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Persistence
T1098 Account Manipulation; T1098.001 Additional Cloud Credentials
Initial Access
T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1552.001 Credentials In Files
lateral-movement
T1550.001 Application Access Token
defense-impairment
Impact
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1584 Compromise Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities
Affected products and versions in Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub
- Microsoft — Azure Sentinel (GitHub repository CI/CD workflows)
Vulnerable versions: workflow configuration at time of disclosure
Fixed in: not publicly detailed - Google — AI Agent Development Kit (adk-samples)
Vulnerable versions: workflow configuration at time of disclosure
Fixed in: not publicly detailed - Apache Software Foundation — Apache Doris
Vulnerable versions: workflow configuration at time of disclosure
Fixed in: hardening patch applied post-disclosure - Cloudflare — Workers SDK (Wrangler CLI)
Vulnerable versions: workflow configuration at time of disclosure
Fixed in: hardening patch applied post-disclosure - Python Software Foundation — Black (code formatter)
Vulnerable versions: workflow configuration at time of disclosure
Fixed in: hardening patch applied post-disclosure
Remediation for Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub
Patches
- Cloudflare Workers SDK (Wrangler CLI): hardening fix applied post-disclosure
- Python Software Foundation Black: hardening fix applied post-disclosure
- Apache Doris: hardening fix applied post-disclosure
- Microsoft Azure Sentinel: impact confirmed by vendor (remediation status not detailed in public reporting)
- Google AI Agent Development Kit (adk-samples): impact confirmed by vendor (remediation status not detailed in public reporting)
Immediate actions
- Audit all workflows triggered on pull_request_target, workflow_run, or issue_comment for checkout-and-execute of forked-PR code
- Never interpolate github.event.pull_request.title, github.head_ref, branch names, or comment bodies directly into run: shell steps or JS expressions — pass them through env: variables instead
- Set default GITHUB_TOKEN permissions to read-only at the org and workflow level (permissions: contents: read) and grant elevated scopes only per-job where strictly required
- Rotate and replace any non-expiring GitHub App private keys or personal access tokens used by CI with short-lived, narrowly-scoped credentials
- Remove hardcoded CI credentials from workflow files and repository secrets that are reachable from PR-triggered contexts
- Require manual approval ('require approval for first-time contributors' / environments with required reviewers) before privileged workflows run against fork PRs
Workarounds
- Temporarily disable pull_request_target / workflow_run triggers on repositories until workflows are audited
- Restrict Actions to run only for collaborators/members pending a full workflow security review
Longer-term hardening
- Split workflows so untrusted checkout/build steps never share a job or token scope with steps that use secrets or push credentials
- Adopt cross-workflow data-flow review (artifacts, job outputs, GITHUB_ENV/GITHUB_OUTPUT) as a standing part of CI/CD security review, since SAST/DAST does not catch this class
- Pin all third-party Actions to full-length commit SHAs, not tags, and monitor for supply-chain compromise of dependency Actions
- Adopt OIDC federated cloud credentials (AWS/GCP/Netlify) instead of long-lived static secrets stored in CI
- Deploy CI/CD-specific posture tools capable of reasoning across multiple workflow files and trust boundaries, not just single-file static analysis
Weaknesses (CWE) in Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub
CWE-78, CWE-94, CWE-284, CWE-269
Timeline of Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub
- The Hacker News, Dark Reading, Security Boulevard, and other outlets report on the Cordyceps findings, amplifying disclosure to the broader developer community.
- Microsoft and Google confirm impact from the disclosed findings.
- Cloudflare, the Python Software Foundation, and Apache apply hardening fixes to their affected workflows following disclosure.
- Python Software Foundation's Black formatter found exploitable via any PR stealing the project's automation bot token, with a secondary Docker Hub credential exposure risk.
- Cloudflare's Workers SDK (Wrangler CLI) found exploitable via malicious branch names enabling arbitrary command execution on CI runners.
- Apache Doris found exploitable via two paths: PR-comment credential exfiltration and forked-PR token theft with full write scope across actions, contents, packages, and pages.
- Google's AI Agent Development Kit (adk-samples, 9,200+ stars) found exploitable via a single crafted pull request, escalating to GCP roles/owner.
- Microsoft Azure Sentinel found vulnerable to anonymous PR-comment-triggered code execution, exposing a non-expiring GitHub App key with persistent write access to security content deployed via Azure Marketplace.
- Manual validation confirms 300+ repositories as fully exploitable for code execution, credential theft, or supply-chain compromise, including at Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation.
- Automated scan flags 654 candidate repositories exhibiting the vulnerable pull-request-triggered privilege pattern.
- Novee Security publishes the Cordyceps research, disclosing a systemic class of GitHub Actions CI/CD trust-boundary flaws found across ~30,000 scanned high-impact repositories.
Sources cited for Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub
- Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
- Cordyceps: The Silent Parasite Consuming Your Supply Chain
- 'Cordyceps': Malicious Pull Requests Threaten CI/CD Workflows
- Cordyceps CI/CD Weakness Exposes Software Supply Chains to Malicious Pull Requests
- Novee Security Exposes CI/CD Flaws Across 300+ GitHub Repos
- GitHub Actions Supply Chain Flaw Exposes Microsoft and Google to Free-Account Hijack
- Cordyceps flaws let anyone with a free GitHub account hijack CI/CD pipelines at Microsoft, Google, and Apache
- Hundreds of Open Source Projects Exposed to CI/CD Attack Pattern
- Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests
- GitHub Actions Pwn Request Vulnerability
- Long Live the Pwn Request: Hacking Microsoft GitHub Repositories and More
- Securely using pull_request_target
Threats related to Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub
- Cordyceps: Systemic Cross-Workflow Privilege-Escalation Supply-Chain Flaw in GitHub Actions CI/CD Pipelines (Microsoft Azure Sentinel, Google ADK, Apache Doris, Cloudflare Workers SDK, PSF Black)
- GitHub and PyPI Add Time-Based Defenses Against Supply-Chain Attacks
- python.org Release Management API Authentication Bypass (Patched, No Exploitation Confirmed)
- Autonomous AI Agent (GPT-5.6 Sol) Chains Zero-Day and Stolen Credentials to Breach Hugging Face Production Infrastructure
- Shai-Hulud npm Supply-Chain Worm: Two Alleged TeamPCP Members Charged by AFP/FBI
Detection coverage for TL-2026-1021
As of 2026-06-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1021 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.