Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks

Cybersecurity researchers at Novee Security have identified a critical exploitable pattern in CI/CD workflows, codenamed Cordyceps, that allows unauthenticated attackers to hijack workflows and compromise open-source supply chains. The flaw affects over 300 high-impact GitHub repositories, including those of major organizations such as Microsoft, Google, Apache, and Cloudflare.

The vulnerability stems from weak CI/CD configurations that grant pull requests (PRs) excessive permissions. An untrusted PR can trigger privileged workflows, enabling command injection, privilege escalation, and supply chain compromise. Novee Security’s scan of approximately 30,000 repositories revealed that more than 300 are fully exploitable, allowing attacker-controlled code execution, credential theft, and downstream supply chain attacks.

Specific examples include Microsoft’s Azure Sentinel, where a comment on a PR could run anonymous attacker code and steal a non-expiring GitHub App key. On Google’s AI Agent Development Kit (adk-samples), a PR could execute attacker code to gain complete authority over a Google Cloud repository. Other affected projects include Apache Doris, Cloudflare Workers SDK, and the Python Software Foundation’s Black.

Following responsible disclosure, Microsoft and Google confirmed impact, while Cloudflare, Python, and Apache have applied hardening and patches. The researchers emphasize that the vulnerability arises from the composition of trusted and untrusted data crossing trust boundaries, making it difficult for traditional scanners to detect.