Answer Brief
Novee Security’s discovery of the Cordyceps CI/CD flaw exposes a widespread misconfiguration in GitHub Actions workflows where excessive permissions granted to pull requests enable unauthenticated attackers to hijack build systems, steal credentials, and compromise software supply chains across major technology organizations, highlighting critical gaps in trust boundary enforcement in automated development environments.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
Public disclosure of Cordyceps CI/CD flaw by Novee Security via The Hacker News
- 2
Microsoft and Google confirm impact following responsible disclosure
- 3
Cloudflare, Python Software Foundation, and Apache apply hardening and patches to affected repositories
Executive Summary: Novee Security’s discovery of the Cordyceps CI/CD flaw exposes a widespread misconfiguration in GitHub Actions workflows where excessive permissions granted to pull requests enable unauthenticated attackers to hijack build systems, steal credentials, and compromise software supply chains across major technology organizations, highlighting critical gaps in trust boundary enforcement in automated development environments.
Why It Matters
The Cordyceps CI/CD flaw represents more than a isolated misconfiguration; it exposes a fundamental tension in modern software development between the openness required for collaborative innovation and the security controls needed to protect build integrity. At its core, the vulnerability arises from the excessive delegation of trust to pull_request triggers in GitHub Actions workflows, where permissions intended for trusted contributors are inadvertently extended to any GitHub user, including anonymous actors. This misalignment creates a trust boundary violation: untrusted input from external contributors can initiate privileged operations that should be reserved for vetted maintainers. Novee Security’s scan of 30,000 high-impact repositories revealed that over 300 contained configurations where pull requests could trigger workflows with write access to critical secrets such as GITHUB_TOKEN, cloud service tokens, or signing keys—enabling credential theft, arbitrary code execution, and potential supply chain poisoning. The technical mechanism varies across affected projects but consistently exploits the implicit trust placed in workflow automation. In Microsoft’s Azure Sentinel, a simple comment on a pull request was sufficient to trigger code execution that could exfiltrusted a non-expiring GitHub App key. In Google’s AI Agent Development Kit (adk-samples), a similar PR comment allowed attackers to gain complete authority over a Google Cloud repository. At Apache Doris, two zero-click attack vectors were identified: one where any PR comment could execute code and exfiltrate hard-coded CI credentials, and another where a forked PR could achieve the same outcome. Cloudflare Workers SDK demonstrated vulnerability through crafted branch names that triggered arbitrary command execution on CI runners, while the Python Software Foundation’s Black tool allowed any pull request to execute code and steal its automation token—a credential that could then be used to approve malicious changes without review. What makes Cordyceps particularly insidious is its reliance on legitimate platform features. The flaw does not require exploiting a bug in GitHub Actions itself but rather abuses the intended functionality of workflow triggers when combined with overly permissive configurations. As Novee Security emphasized, 'The workflow does what it was told. The vulnerability exists only in the composition.' This means traditional vulnerability scanners, which assess individual components for known weaknesses, fail to detect Cordyceps because each element—the PR trigger, the workflow job, the secret access—is operating as designed. The risk emerges only from their interaction, highlighting a critical gap in security tooling that focuses on component-level validation rather than systemic trust modeling. The implications extend beyond immediate code execution. Stolen credentials such as GitHub App keys or cloud tokens can establish persistent access, enabling attackers to manipulate future releases, inject malware into software distributions, or maintain long-term footholds within development infrastructure. In the context of agentic coding—where AI systems autonomously generate, submit, and iterate on code—the risk amplifies. Untrusted AI-generated contributions could inadvertently or maliciously trigger these workflow paths, allowing threat actors to 'puppeteer' build processes at scale without direct interaction. As Meged warned, this creates a scenario where repositories are 'silently manipulated' through legitimate automation channels. The confirmed responses from Microsoft, Google, Cloudflare, Apache, and the Python Foundation validate the severity of the finding and demonstrate a pathway to mitigation: applying the principle of least privilege to CI/CD configurations. This includes restricting pull_request workflows to read-only tokens where possible, implementing required approvals for privileged operations, using environment protections to gate secret access, and enforcing branch protection rules that prevent untrusted code from triggering sensitive workflows. Organizations should also audit existing workflows for excessive permissions, monitor for anomalous workflow runs from first-time or anonymous contributors, and consider implementing automated checks for trust boundary violations in CI/CD YAML files. Ultimately, the Cordyceps discovery underscores that supply-chain security must encompass not only the provenance of code but also the integrity of the automation that builds, tests, and deploys it. As open-source collaboration continues to grow and AI-driven development becomes more prevalent, securing the trust boundaries within CI/CD pipelines will be essential to preventing silent compromise at the foundation of the software supply chain.
Event Type: security
Importance: high
Affected Companies
- Apache
- Cloudflare
- Microsoft
- Python Software Foundation
Affected Sectors
- Cloud Computing
- Open Source
- Software Development
- Technology
Key Numbers
- Number of exploitable repositories identified: 300+
- Total high-impact repositories scanned: 30,000
Timeline
- Public disclosure of Cordyceps CI/CD flaw by Novee Security via The Hacker News
- Microsoft and Google confirm impact following responsible disclosure
- Cloudflare, Python Software Foundation, and Apache apply hardening and patches to affected repositories
Frequently Asked Questions
What is the Cordyceps CI/CD flaw and how does it work?
The Cordyceps flaw is a critical exploitable pattern in CI/CD workflows that allows unauthenticated attackers to hijack GitHub Actions workflows via untrusted pull requests. By exploiting excessive permissions granted to PRs, attackers can execute arbitrary code, steal credentials, and gain full control over repositories without needing special privileges or organization membership.
Which major organizations were found to have exploitable repositories due to the Cordyceps flaw?
Microsoft, Google, Apache, and Cloudflare were identified as having exploitable repositories in the Novee Security scan. Specific examples include Azure Sentinel, Google’s AI Agent Development Kit (adk-samples), Apache Doris, Cloudflare Workers SDK, and the Python Software Foundation’s Black tool.
What actions have affected organizations taken in response to the Cordyceps disclosure?
Following responsible disclosure, Microsoft and Google confirmed the impact of the flaw. Cloudflare, the Python Software Foundation, and the Apache Software Foundation have applied hardening measures and patches to mitigate the vulnerability in their respective repositories and CI/CD systems.
Why does the Cordyceps flaw evade traditional security scanners?
The Cordyceps flaw evades traditional scanners because it stems from systemic misconfigurations in workflow trust boundaries rather than vulnerabilities in individual components. As Novee Security explained, 'The workflow does what it was told. The vulnerability exists only in the composition – untrusted data crossing a trust boundary that no one audited.' Scanners validate that each piece works as designed but fail to detect when legitimate mechanisms are composed in ways that allow unintended privilege escalation.
How does the rise of agentic coding increase the risk posed by flaws like Cordyceps?
As noted by Novee Security’s Elad Meged, the nature of agentic coding means these CI/CD vulnerabilities are reproduced persistently and at scale, 'infecting' repositories exponentially. AI-driven automation that autonomously generates and submits code increases the likelihood of untrusted input entering privileged workflows, amplifying the risk of silent manipulation where attackers can 'puppeteer' build processes without detection.