# Cordyceps: Systemic CI/CD Workflow Flaws Expose 300+ GitHub Repositories (Microsoft, Google, Apache, Cloudflare, PSF) to Supply-Chain Attacks

> Novee Security researcher Elad Meged codenamed "Cordyceps" a systemic class of GitHub Actions CI/CD misconfigurations — command injection, code injection, broken authorization, and cross-workflow privilege escalation — that let any free, unauthenticated GitHub account forge approvals, push code, or steal credentials. A scan of ~30,000 high-impact repositories flagged 654 candidates and confirmed 300+ as fully exploitable, including at Microsoft Azure Sentinel, Google's AI Agent Development Kit, Apache Doris, Cloudflare's Workers SDK, and the Python Software Foundation's Black.

- **Published:** 2026-06-30T00:00:00Z
- **Last reviewed:** 2026-06-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1021
- **ID:** TL-2026-1021
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cordyceps is not a single CVE but a named research campaign describing a recurring, exploitable pattern in GitHub Actions CI/CD pipelines: workflows that grant pull-request-triggered jobs more trust and privilege than the PR's origin warrants. Novee Security enumerated four root vulnerability classes across the ~30,000 high-impact open-source repositories it scanned (npm, PyPI, crates.io, and Go ecosystems): (1) command injection, where attacker-controlled strings — PR titles, branch names, and PR/issue comment bodies — are interpolated unsanitized into `run:` shell steps (CWE-78); (2) code injection, where untrusted input is evaluated at runtime through GitHub Actions' JavaScript expression/templating engine, analogous to server-side template injection; (3) broken authorization, where existing permission checks contain logic bugs that silently fail open rather than being altogether absent; and (4) cross-workflow privilege escalation, where untrusted data flows from a low-privilege workflow into a high-privilege one via artifacts, job outputs, or the GITHUB_ENV/GITHUB_OUTPUT environment files, letting a benign-looking first-stage workflow smuggle a malicious payload into a second, privileged workflow that runs with repository secrets and a broadly-scoped GITHUB_TOKEN. This is a scaled, cross-organization instantiation of the long-documented 'pwn request' pattern (workflows triggered on `pull_request_target` or similar that check out and execute forked-PR code with base-repo privileges), which GitHub Security Lab and other researchers (e.g., Praetorian's 'Long Live the Pwn Request') have previously documented individually. Novee's contribution is treating it as a systemic, at-scale supply-chain risk: no org membership, write access, or paid account is required — a free GitHub account is sufficient to open a PR, push to a fork, rename a branch, or leave a comment that triggers the vulnerable automation. Confirmed impact spanned five flagship organizations. At Microsoft Azure Sentinel, PR comments triggered anonymous code execution on Microsoft's CI systems, exposing a non-expiring GitHub App key that grants persistent write access to security content later deployed to customers via Azure Marketplace. At Google's AI Agent Development Kit (adk-samples, 9,200+ stars), a single crafted pull request executed attacker code inside Google Cloud CI, escalating to `roles/owner` — the highest possible GCP IAM permission. At Apache Doris, two independent chains were validated: PR comments exfiltrating hardcoded CI credentials, and a forked-PR path stealing tokens scoped to full write across actions, contents, packages, and pages. At Cloudflare's Workers SDK (Wrangler CLI), maliciously crafted branch names achieved arbitrary command execution on CI runners (code execution confirmed; no production secret escalation identified at that entry point). At the Python Software Foundation's Black (130M+ monthly installs), a PR from any account could steal the project's automation bot token, which itself carried PR-approval and protected-branch push authority, with a secondary Docker Hub credential exposure risk. Novee validated end-to-end exploitation (not just theoretical trust-boundary gaps) across a wide attack-surface matrix: publishing malicious packages to npm, PyPI, crates.io, Docker Hub/GHCR, and Helm; direct pushes to protected branches; forging CI status checks to bypass merge gates; theft of cloud credentials (AWS, GCP, Netlify); persistent compromise of self-hosted runners; and bot impersonation/social engineering. The researchers note traditional SAST/DAST/AST tooling structurally cannot find this class of bug because it requires reasoning across multiple workflow files and their differing trust levels — exactly the kind of cross-file, intent-aware analysis static scanners are not built for. Cloudflare, the Python Software Foundation, and Apache applied hardening fixes after disclosure; Microsoft and Google confirmed impact. Novee separately flags that AI-assisted ('agentic') coding threatens to reproduce these same insecure CI/CD patterns at even greater scale and speed across the open-source ecosystem.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1059.007 JavaScript
- T1098 Account Manipulation
- T1098.001 Additional Cloud Credentials
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1553 Subvert Trust Controls
- T1036 Masquerading
- T1550.001 Application Access Token
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1005 Data from Local System
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation

## Sources

- [Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks](https://thehackernews.com/2026/06/cordyceps-cicd-flaws-expose-300-github.html)
- [Cordyceps: The Silent Parasite Consuming Your Supply Chain](https://novee.security/blog/cordyceps/)
- ['Cordyceps': Malicious Pull Requests Threaten CI/CD Workflows](https://www.darkreading.com/application-security/cordyceps-malicious-pull-requests-developer-workflows)
- [Cordyceps CI/CD Weakness Exposes Software Supply Chains to Malicious Pull Requests](https://securityboulevard.com/2026/06/cordyceps-ci-cd-weakness-exposes-software-supply-chains-to-malicious-pull-requests/)
- [Novee Security Exposes CI/CD Flaws Across 300+ GitHub Repos](https://aiweekly.co/alerts/novee-security-exposes-cicd-flaws-across-300-github-repos)
- [GitHub Actions Supply Chain Flaw Exposes Microsoft and Google to Free-Account Hijack](https://www.techtimes.com/articles/319065/20260625/github-actions-supply-chain-flaw-exposes-microsoft-google-free-account-hijack.htm)
- [Cordyceps flaws let anyone with a free GitHub account hijack CI/CD pipelines at Microsoft, Google, and Apache](https://www.mexc.com/news/1173013)
- [Hundreds of Open Source Projects Exposed to CI/CD Attack Pattern](https://www.israeldefense.co.il/en/node/69529)
- [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/)
- [GitHub Actions Pwn Request Vulnerability](https://www.stepsecurity.io/blog/github-actions-pwn-request-vulnerability)
- [Long Live the Pwn Request: Hacking Microsoft GitHub Repositories and More](https://www.praetorian.com/blog/pwn-request-hacking-microsoft-github-repositories-and-more/)
- [Securely using pull_request_target](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1021