News

Researchers at Novee Security have uncovered a new category of continuous integration/continuous delivery (CI/CD) misconfiguration they call “Cordyceps,” which can be weaponized to take over workflows and undermine open-source software supply chains. According to the firm, this is a “critical exploitable pattern” that, if present, permits attackers to gain full control of repositories at a number of high-profile organizations.

Elad Meged, a founding engineer and security researcher at Novee, warned that the flaw can be leveraged by anyone without authentication - a free GitHub account is sufficient. Attackers do not need to be organization members or hold special privileges to exploit the weakness; they can forge approvals, push malicious changes, or exfiltrate secrets from targeted projects.

To assess the scale of the exposure, Novee scanned roughly 30,000 repositories it judged high-impact. The company says it found over 300 repositories that were entirely exploitable through this pattern, enabling remote code execution driven by attacker-controlled inputs, theft of credentials, and broader supply-chain compromise with potentially far-reaching consequences.

At the heart of Cordyceps are CI/CD workflows that grant pull requests (PRs) more privileges than appropriate. PRs-requests to merge changes from one branch into another-are common in collaborative development, but when an untrusted PR triggers workflows that run with elevated permissions, it becomes an attack vector. This misconfiguration can allow command injection, escalation of privileges, and ultimately contamination of downstream consumers of the affected software.

Novee characterizes the problem as a composition error in trusted automation: each individual component behaves as designed, but the way untrusted data crosses an unchecked trust boundary creates the vulnerability. In other words, the workflows perform their configured actions; the security gap arises because nobody audited the interactions that allow untrusted inputs to exercise privileged capabilities.

The firm disclosed multiple real-world examples. In Microsoft’s Azure Sentinel project, Novee found a pull-request comment that could execute attacker-supplied code on Microsoft’s CI infrastructure and steal a non-expiring GitHub App key. A similar issue in Google’s AI Agent Development Kit (“adk-samples”) could allow an attacker to run code on Google’s CI and obtain full control of a Google Cloud repository.

Additional findings included: in Apache Doris, two zero-click attack variants could let a single comment on any PR-or on a forked PR-run attacker code and exfiltrate hard-coded CI credentials or a token with full write scopes; in the Cloudflare Workers SDK, a pull request using a specially crafted branch name could trigger arbitrary commands on Cloudflare’s CI runners; and in the Python Software Foundation’s Black project, any pull request could execute code on Black’s build systems and siphon the automation token, which in turn could be used to approve other pull requests.

Following responsible disclosure, Microsoft and Google acknowledged the impact of Novee’s findings. Cloudflare, the Python Software Foundation, and Apache have implemented hardening measures or patches to remediate the issues Novee reported.

Meged emphasized that the problem can propagate rapidly because automated development agents and repeated CI configurations reproduce the same vulnerable patterns across many repositories. Because anonymous accounts can exploit these flaws to seize control of parts of the software supply chain, Novee likens the effect to silently “puppeteering” repositories at major companies by manipulating their workflows.

These Cordyceps-class vulnerabilities highlight a broader need for tighter CI/CD governance: treating PRs and other external inputs as untrusted, restricting workflow permissions, and auditing how data moves across trust boundaries can help prevent attackers from turning build automation into an attack surface for supply-chain compromise.