Cordyceps Flaws Expose 300+ GitHub Repos to CI/CD Supply-Chain Attacks

Cybersecurity researchers at Novee Security have identified a critical class of CI/CD workflow misconfiguration dubbed "Cordyceps" that exposes more than 300 high-impact GitHub repositories to full supply-chain compromise. The weakness, found across approximately 30,000 scanned repositories, allows any unauthenticated user—no special privileges or even a paid GitHub account required—to forge workflow approvals, push malicious code, and steal CI credentials. Elad Meged, founding engineer at Novee, warned that the issue enables command injection, privilege escalation, and downstream attacks against the open-source ecosystem.

The root cause lies in CI/CD pipelines that grant pull requests excessive permissions, allowing untrusted code contributions to trigger privileged workflows. Real-world impact spans some of the largest names in technology. On Microsoft Azure Sentinel, a single PR comment could execute anonymous attacker code and exfiltrate a non-expiring GitHub App key. Google's adk-samples repository was similarly vulnerable, with a malicious PR capable of seizing full authority over a Google Cloud repository. Apache Doris, Cloudflare Workers SDK, and the Python Software Foundation's Black formatter were also confirmed exploitable—the latter allowing any PR to steal an automation token usable for approving future code merges. Developers auditing their own pipelines can start with an SSL/TLS checker to verify transport security, and use a WHOIS lookup to confirm domain ownership of any suspicious external services referenced in their workflows.

Both Microsoft and Google have confirmed impact following responsible disclosure, while Cloudflare, the Python Software Foundation, and Apache have deployed hardening measures and patches. Novee emphasized that each individual workflow component behaves as designed—the danger emerges only when untrusted data crosses an unaudited trust boundary, a pattern that evades conventional static scanners. As agentic coding tools proliferate, the risk multiplies: AI-generated workflows can reproduce these insecure patterns at scale, exponentially accelerating exposure across the open-source landscape. Security teams should treat every PR-triggered workflow as a potential entry point, enforce strict least-privilege token scoping, and require manual approval gates for any pipeline that accesses production secrets.