Malicious Pull Request Targeted Antrea’s Jenkins CI; Attacker Claimed Root Access
Summary
A malicious Antrea pull request triggered Jenkins tests and included payloads to probe the controller and collect credentials. Maintainers closed it as an exfiltration attempt; the attacker claimed root access, which the article does not independently confirm.
Key points
- A newly created GitHub account opened Antrea PR #8027 and posted five Jenkins test slash commands within seconds, triggering jobs against pull-request code.
- The pull request included payloads designed to probe the Jenkins controller, retrieve EC2 role credentials, and collect secrets and configuration files from CI workers.
- The Antrea team closed the PR, describing it as an attempt to exfiltrate credentials, and said it blocked the user and reported the account to GitHub.
- The attacker later claimed to have destroyed a worker and gained root access to the controller; the article provides no independent confirmation of those claims.
- The article links the activity to similar pull-request campaigns targeting at least eight open-source projects, while treating the earlier Trivy supply-chain incident as separate context.
- Recommended defenses include pinning third-party GitHub Actions to specific SHAs and requiring maintainer approval before fork-originated pull requests can trigger privileged CI jobs.
Article Details
- Victim Organization
- Antrea
- Victim Domain
- antrea.io
- Incident Type
- Malicious pull request triggered Jenkins CI jobs to execute payload code, attempt credential collection and exfiltration, and compromise a Jenkins worker; the operator claimed root access to the Jenkins controller.
- Incident Date
- 2026-05-02
- Data Types Exposed
- AWS instance role credentials
- Environment variables containing tokens, secrets, keys, passwords, credentials, or authentication data
- Docker, Kubernetes, and cloud credentials
- Jenkins credential store files
- SSH private keys and certificates
- Operational Impact
- The malicious pull request triggered five Jenkins test jobs. The operator claimed to have compromised a worker and gained root access to the controller; the article describes the payload's credential collection and exfiltration attempts but does not confirm what data was successfully obtained.
- Ransom Or Extortion
- None reported
- Claim Status
- claimed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//paste[.]rs/ | Pastebin collector URL identified in the malicious payload as an exfiltration channel for AWS metadata and SSH configuration. |
| URL | hxxps[:]//webhook[.]site/1d98b695-72df-4e88-885c-5efeb3df75f7 | Webhook collector URL identified in the malicious payload as an exfiltration channel for credential data. |
MITRE ATT&CK
T1036 · MasqueradingThe operator used unverified committer email addresses and spoofed Antrea's CI identity on malicious commits.T1059 · Command and Scripting InterpreterThe Jenkins payload invoked operating-system commands and shell scripts to inspect the environment and collect files.T1078 · Valid AccountsThe operator attempted to obtain and use credentials exposed to CI jobs; successful credential use is not confirmed.T1195.001 · Compromise Software Dependencies and Development ToolsThe operator submitted a malicious pull request that inserted payload code into the project's CI workflow.T1528 · Steal Application Access TokenThe payload queried the EC2 instance metadata service for instance role credentials.T1552 · Unsecured CredentialsThe payload searched environment variables and credential files, including AWS, Docker, Kubernetes, and Jenkins credentials.T1567.002 · Exfiltration to Cloud StorageThe payload attempted to exfiltrate collected data using public paste and webhook services.
Threat Actors
Vendors
BroadcomEight days after the Trivy attack window closed, an antrea maintainer at Broadcom merged PR #7905 ("security: Pins trivy actions to specific SHA") at 2026-03-27 05:17:46 UTC, pinning to a pre-attack-safe version ofWizIn March 2026, the maintainers of Trivy’s GitHub Actions (aquasecurity/trivy-action and aquasecurity/setup-trivy) were hit by a supply-chain attack. Wiz attributed the campaign to a cluster they call TeamPCP.
Products
AntreaTL;DR. On May 2, a threat actor escalated against the popular open-source CNCF project Antrea by opening a malicious pull request designed to trick CI into running code and exfiltrating credentials, claimed root accessAWStheir full e2e test suite in GitHub Actions — they have a self-hosted Jenkins fleet sitting in their own AWS account. The pattern looks like this:GitHub ActionsIn March 2026, the maintainers of Trivy’s GitHub Actions (aquasecurity/trivy-action and aquasecurity/setup-trivy) were hit by a supply-chain attack. Wiz attributed the campaign to a cluster they call TeamPCP.Jenkinsdesigned to trick CI into running code and exfiltrating credentials, claimed root access to Antrea’s Jenkins infrastructure, and then taunted maintainers before the PR was shut down. Antrea was a user ofTrivyand then taunted maintainers before the PR was shut down. Antrea was a user of aquasecurity/trivy-action during the March 2026 Trivy supply-chain compromise window, but the antrea team has stated that