Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub Repositories (Microsoft, Google, Apache, Cloudflare, PSF) to Supply-Chain Attacks — Threadlinqs Intelligence
As of 2026-06-30, Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub Repositories (Microsoft, Google, Apache, Cloudflare, PSF) to Supply-Chain Attacks is a critical-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-1021 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Novee Security researcher Elad Meged codenamed "Cordyceps" a systemic class of GitHub Actions CI/CD misconfigurations — command injection, code injection, broken authorization, and cross-workflow
Cordyceps is not a single CVE but a named research campaign describing a recurring, exploitable pattern in GitHub Actions CI/CD pipelines: workflows that grant pull-request-triggered jobs more trust and privilege than the PR's origin warrants. Novee Security enumerated four root vulnerability classes across the ~30,000 high-impact open-source repositories it scanned (npm, PyPI, crates.io, and Go ecosystems): (1) command injection, where attacker-controlled strings — PR titles, branch names, and PR/issue comment bodies — are interpolated unsanitized into `run:` shell steps (CWE-78); (2) code injection, where untrusted input is evaluated at runtime through GitHub Actions' JavaScript expression/templating engine, analogous to server-side template injection; (3) broken authorization, where existing permission checks contain logic bugs that silently fail open rather than being altogether absent; and (4) cross-workflow privilege escalation, where untrusted data flows from a low-privilege workflow into a high-privilege one via artifacts, job outputs, or the GITHUB_ENV/GITHUB_OUTPUT environment files, letting a benign-looking first-stage workflow smuggle a malicious payload into a second, privileged workflow that runs with repository secrets and a broadly-scoped GITHUB_TOKEN. This is a scaled, cross-organization instantiation of the long-documented 'pwn request' pattern (workflows triggered on `pull_request_target` or similar that check out and execute forked-PR code with base-repo privileges), which GitHub Security Lab and other researchers (e.g., Praetorian's 'Long Live the Pwn Request') have previously documented individually. Novee's contribution is treating it as a systemic, at-scale supply-chain risk: no org membership, write access, or paid account is required — a free GitHub account is sufficient to open a PR, push to a fork, rename a branch, or leave a comment that triggers the vulnerable automation. Confirmed impact spanned five flagship organizations. At Microsoft Azure Sentinel, PR comments triggered anonymous code execution on Microsoft's CI systems, exposing a non-expiring GitHub App key that grants persistent write access to security content later deployed to customers via Azure Marketplace. At Google's AI Agent Development Kit (adk-samples, 9,200+ stars), a single crafted pull request executed attacker code inside Google Cloud CI, escalating to `roles/owner` — the highest possible GCP IAM permission. At Apache Doris, two independent chains were validated: PR comments exfiltrating hardcoded CI credentials, and a forked-PR path stealing tokens scoped to full write across actions, contents, packages, and pages. At Cloudflare's Workers SDK (Wrangler CLI), maliciously crafted branch names achieved arbitrary command execution on CI runners (code execution confirmed; no production secret escalation identified at that entry point). At the Python Software Foundation's Black (130M+ monthly installs), a PR from any account could steal the project's automation bot token, which itself carried PR-approval and protected-branch push authority, with a secondary Docker Hub credential exposure risk. Novee validated end-to-end exploitation (not just theoretical trust-boundary gaps) across a wide attack-surface matrix: publishing malicious packages to npm, PyPI, crates.io, Docker Hub/GHCR, and Helm; direct pushes to protected branches; forging CI status checks to bypass merge gates; theft of cloud credentials (AWS, GCP, Netlify); persistent compromise of self-hosted runners; and bot impersonation/social engineering. The researchers note traditional SAST/DAST/AST tooling structurally cannot find this class of bug because it requires reasoning across multiple workflow files and their differing trust levels — exactly the kind of cross-file, intent-aware analysis static scanners are not built for. Cloudflare, the Python Software Foundation, and Apache applied hardening fixes after disclosure; Microsoft and Google confirmed impact. Novee separa
Weaknesses (CWE)
CWE-78, CWE-94, CWE-284, CWE-269
Target sectors: software development, technology, cloud infrastructure, open source ecosystem
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1585, T1584, T1587, T1195, T1195.002, T1199, T1059, T1059.004, T1059.007, T1098