CI/CD Workflow Flaws Enable Unauthenticated Code Execution in 300+ GitHub Repositories at Microsoft, Google, Apache
CI/CD misconfigurations in GitHub Actions created an unauthenticated supply-chain vector affecting over 300 major repositories. The issue evades standard scanners because each component functions as intended until untrusted PR data crosses into privileged execution contexts. Remediation requires explicit workflow permissions and trigger restrictions rather than reliance on existing tooling.
The Cordyceps pattern stems from GitHub Actions configurations that allow PRs from forks or external comments to trigger privileged jobs without trust boundaries. Attackers can inject commands via branch names, issue comments, or crafted inputs to steal non-expiring tokens or GitHub App keys. Specific cases include Azure Sentinel leaking a persistent App key and Google's adk-samples granting full repository write access through a single PR.
Evidence comes from direct reproduction on production workflows rather than static analysis alone. Novee demonstrated zero-click paths on Apache Doris and Black where a forked PR or comment alone exfiltrated CI secrets. This matches patterns seen in prior incidents such as the 2021 Codecov bash uploader compromise and the 2023 GitHub Actions artifact poisoning cases, where composition errors bypassed per-repo scanner rules.
Microsoft and Google acknowledged impact after disclosure while Cloudflare, Apache, and PSF applied targeted hardening. The persistent risk lies in agentic coding tools that replicate these workflows at scale without auditing cross-boundary data flows. Future exposure will depend on whether GitHub enforces default PR isolation or organizations adopt explicit allowlists for workflow triggers.
SENTINEL: Within 120 days, GitHub will release default workflow isolation settings after at least two additional Fortune 100 organizations disclose similar exposures.
Sources (3)
- [1]Novee Security Cordyceps Technical Report(https://novee.security/research/cordyceps)
- [2]The Hacker News Cordyceps Disclosure(https://thehackernews.com/2026/06/cordyceps-cicd-flaws-expose-300-github.html)
- [3]GitHub Actions Security Best Practices(https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)