Cordyceps GitHub Actions Attack Pattern Evades CI Security Scanners

Summary

Novee Security reported that its Cordyceps pattern affected GitHub Actions workflows: over 300 of 654 flagged repositories were confirmed exploitable. The article explains the risks, cites confirmed cases at Microsoft, Google and Apache, and offers mitigations.

Key points

Novee scanned roughly 30,000 high-impact repositories across npm, PyPI, crates.io and Go, flagging 654 and confirming more than 300 as fully exploitable.
The pattern combines untrusted pull-request content with privileged pull_request_target or workflow_run workflows, potentially exposing secrets and write-capable tokens.
Described techniques include shell command injection, JavaScript injection through actions/github-script, and passing attacker-controlled artifacts or outputs between workflows with different privileges.
Novee reported confirmed cases involving Microsoft’s Azure Sentinel repository, Google’s AI Agent Development Kit samples and Apache Doris; the article says the vendors hardened or fixed the paths.
The article says there was no evidence of exploitation in the wild and presents Cordyceps as an exploitable pattern, not a single specific breach.
Suggested mitigations include preferring pull_request, avoiding checkout of pull-request code in privileged workflows, safely passing event data, using read-only permissions, pinning actions to commit SHAs and requiring approval for first-time contributors.

Article Details

Topic: Cordyceps CI/CD vulnerability pattern in GitHub Actions workflows, where combinations of privileged workflow triggers and attacker-controlled pull request content can expose credentials or enable privilege escalation.

MITRE ATT&CK

T1059 · Command and Scripting InterpreterThe article describes attacker-controlled pull request data being executed as shell commands or JavaScript in CI workflows.

Vendors

ApacheThe affected build tooling included projects published by Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, and the entry requirement for an attacker is a free GitHub account.GoogleThe affected build tooling included projects published by Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, and the entry requirement for an attacker is a free GitHub account.MicrosoftThe affected build tooling included projects published by Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, and the entry requirement for an attacker is a free GitHub account.

Products

GitHub ActionsThe GitHub Actions Attack Pattern Your CI Security Scanners Miss Google Agent Development KitGoogle's AI Agent Development Kit sample repository is a reference thousands of developers copy when building agents on Google Cloud.Google CloudGoogle's AI Agent Development Kit sample repository is a reference thousands of developers copy when building agents on Google Cloud.Microsoft SentinelOn Microsoft's Azure Sentinel repository, Novee showed that a comment on a pull request could run anonymous attacker code on Microsoft's CI and steal a non-expiring GitHub App key, confirmed by Microsoft's Security