Affected Systems

300+ GitHub repositories across major organizations including Microsoft, Google, and Apache. Vulnerability affects GitHub Actions CI/CD workflows. Specific products and versions not disclosed in available data.

Exploitation Status

Vulnerability disclosed by Novee Security researchers. No information provided on active exploitation or public PoC availability. Exploitation allows workflow hijacking and full repository control.

Business Impact

Organizations using affected GitHub repositories face supply-chain compromise risk. Attackers gaining repository control can inject malicious code into builds, steal secrets, modify release artifacts, and compromise downstream consumers. Impact extends beyond directly affected organizations to their software supply chain. Severity rated critical, suggesting low exploitation complexity or high impact.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit all GitHub Actions workflows for unsafe use of pull_request_target triggers, script injections, and untrusted input handling
  • Review GitHub repository settings to restrict workflow permissions using principle of least privilege and enable required reviews for workflow changes
  • Monitor GitHub audit logs for unexpected workflow modifications, new workflow files, or suspicious Actions executions
  • Contact vendors (Microsoft, Google, Apache) and check their security advisories for specific guidance on affected repositories
  • Implement branch protection rules requiring code review and status checks before merging workflow changes

---

# Threat Actor Context

Actor Profile

Cordyceps is not a threat actor but a critical CI/CD workflow vulnerability discovered by cybersecurity researchers at Novee Security. The vulnerability affects GitHub Actions workflows and enables potential attackers to hijack automated processes, gaining unauthorized control over repositories. This represents a supply-chain attack vector targeting the software development lifecycle, with exposure spanning major organizations including Microsoft, Google, and Apache. The vulnerability class exploits weaknesses in continuous integration and deployment pipelines, allowing malicious actors to inject code or manipulate build processes at scale.

TTPs (Tactics, Techniques, Procedures)

The Cordyceps vulnerability enables supply-chain compromise through CI/CD pipeline exploitation. Key techniques include: T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) through GitHub Actions workflow hijacking; T1554 (Compromise Client Software Binary) via malicious code injection into build processes; T1199 (Trusted Relationship) by exploiting trust in automated CI/CD systems; T1078.004 (Valid Accounts: Cloud Accounts) through unauthorized repository access; and T1648 (Serverless Execution) leveraging GitHub Actions runners for malicious operations. The vulnerability allows attackers to achieve T1098 (Account Manipulation) by gaining full repository control and potentially T1496 (Resource Hijacking) of CI/CD infrastructure.

Targets & Patterns

The vulnerability targets software development organizations and open-source projects utilizing GitHub Actions for CI/CD automation. Over 300 repositories are exposed, including those belonging to high-value targets such as Microsoft, Google, and Apache Foundation. The targeting pattern focuses on organizations with complex CI/CD pipelines and automated workflows, where compromised builds could propagate malicious code to downstream consumers. Open-source projects represent particularly attractive targets due to their widespread adoption and trust within the software supply chain. Attackers exploiting this vulnerability could achieve broad impact by compromising widely-used libraries, frameworks, or development tools, affecting countless downstream users and enterprises that depend on these components.

Historical Context

Cordyceps represents the latest in a series of CI/CD and supply-chain vulnerabilities targeting software development infrastructure. This follows similar supply-chain attack vectors including the 2020 SolarWinds compromise (Sunburst), the 2021 Codecov bash uploader incident, and various dependency confusion attacks. The vulnerability aligns with the broader trend of adversaries targeting the software development lifecycle rather than end-user systems directly, recognizing that compromising build pipelines provides multiplicative impact. GitHub Actions-specific vulnerabilities have emerged as a growing concern since the platform's widespread adoption, with previous research identifying issues like pwn requests and workflow poisoning attacks. The discovery by Novee Security contributes to ongoing efforts to secure DevOps toolchains against sophisticated supply-chain threats.

Defensive Recommendations

  • Audit all GitHub Actions workflows for insecure configurations, particularly those using pull_request_target triggers or exposing repository secrets to untrusted code (T1195.001)
  • Implement strict branch protection rules and require code review for workflow file modifications in .github/workflows directories
  • Apply principle of least privilege to GitHub Actions tokens and secrets, using environment-specific secrets and GITHUB_TOKEN permissions restrictions
  • Monitor GitHub Actions audit logs for suspicious workflow executions, unauthorized repository access, or unexpected workflow modifications (T1078.004)
  • Implement supply-chain security controls including dependency pinning with hash verification, SBOM generation, and artifact signing for CI/CD outputs (T1195.001)