Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks

Cybersecurity researchers at Novee Security have disclosed a critical new class of CI/CD workflow vulnerabilities called Cordyceps. This flaw allows unauthenticated attackers to hijack GitHub Actions workflows and seize full control of repositories at major organizations including Microsoft, Google, Apache, and Cloudflare. More than 300 high-impact repositories have already been confirmed fully exploitable, and the researchers warn that AI coding agents are compounding the problem at scale.

What Happened: Cordyceps CI/CD Flaws Expose Open Source Supply Chains

Novee Security published its findings on June 24, 2026, after scanning roughly 30,000 high-impact open-source repositories. The team identified 654 repositories flagged by the same exploitable pattern. Furthermore, more than 300 were validated as fully exploitable, enabling attacker-controlled code execution, credential theft, or outright supply chain compromise.

The vulnerability class exploits weak CI/CD configurations that grant pull requests excessive permissions. Because an untrusted pull request can trigger privileged workflows, attackers can inject commands, escalate privileges, and compromise the software supply chain. The flaw is exploitable by any unauthenticated user with a free GitHub account.

Named after the parasitic fungus that controls its host, Cordyceps reflects how these vulnerabilities silently puppeteer the repositories of some of the world’s largest companies.

Technical Details of the Cordyceps Vulnerability

The core issue lies in GitHub Actions workflows that treat untrusted input as safe. When a workflow runs in response to a pull request, comment, or fork, it often executes with the maintainer’s privileges. Consequently, an attacker-controlled input can cross a trust boundary no one audited.

Novee Security identified several vulnerability classes within Cordyceps:

• Command Injection: Attacker-controlled input from branch names, PR titles, or comment bodies is interpolated directly into shell commands and executed.
• Code Injection: Attacker-controlled input is interpolated into JavaScript code via actions/github-script and evaluated at runtime.
• Broken Authorization: Logic bugs in authorization checks cause silent failures, such as checking a property that does not exist on the triggering event type.
• Cross-Workflow Privilege Escalation: Untrusted data from a low-privilege workflow crosses into a high-privilege workflow via artifacts, outputs, or environment files. Neither workflow is vulnerable alone, but the composition is exploitable.

At Microsoft, a comment on a pull request in the Azure Sentinel repository could run anonymous attacker code and steal a non-expiring GitHub App key. At Google, a single pull request in the AI Agent Development Kit samples repository could execute attacker code and gain roles/owner access to the associated Google Cloud project.

Apache Doris, Cloudflare Workers SDK, and the Python Software Foundation’s Black formatter were also found vulnerable. In the Black case, a stolen automation token could approve pull requests as the project’s own bot, opening a path from code injection to the main branch.

Business and Operational Impact

The downstream reach of Cordyceps spans thousands of organizations that depend on affected open-source infrastructure. The confirmed impacts include:

• Supply chain compromise: Malicious packages published to npm, PyPI, crates.io, Docker Hub, and Helm repositories.
• Direct code modification: Attackers can push code to protected branches without maintainer approval.
• CI check forgery: Malicious actors can forge CI checks and bypass merge gates.
• Cloud credential theft: Stolen credentials across AWS, GCP, and Netlify enable persistent cloud compromise.
• Bot impersonation: Stolen automation tokens allow social engineering and approval manipulation.

Microsoft Sentinel’s Content Hub ships detection rules and playbooks directly into customer security environments. A compromise there could silently weaken or implant malicious infrastructure templates across enterprise deployments.

Google’s AI Agent Development Kit sample repository has over 9,200 stars and serves as the primary reference for developers building AI agents on Google Cloud. Poisoned sample code could propagate to countless downstream applications.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Audit all GitHub Actions workflows for untrusted input handling. Sanitize branch names, PR titles, comments, and other user-controlled inputs before use in shell commands or scripts.
2. Apply the principle of least privilege to workflow permissions. Use explicit permissions blocks and avoid granting write access unless absolutely necessary.
3. Require maintainer approval for workflows triggered by fork pull requests and first-time contributors.
4. Separate low-privilege and high-privilege workflows. Do not allow artifacts or outputs from untrusted workflows to flow into privileged pipelines.
5. Rotate and scope CI secrets tightly. Use short-lived tokens where possible, and limit GitHub App keys to the minimum required permissions.
6. Enable branch protection rules and require signed commits on protected branches.
7. Monitor CI/CD logs for suspicious workflow executions, especially those triggered by new or external contributors.

Long-Term Strategy

Traditional SAST and DAST tools cannot detect cross-workflow exploit chains because they analyze single files in isolation. Organizations should adopt continuous attack validation that reasons across workflow boundaries and proves exploitability end-to-end.

Security teams should also establish CI/CD workflow review as a standard part of the secure development lifecycle. Workflow code is code, and it deserves the same scrutiny as application code.

Bottom line: Cordyceps is not a single bug to patch. It is a systemic pattern in how the industry builds software. Every organization using GitHub Actions or similar workflow platforms should audit their CI/CD configurations immediately, because a free GitHub account is all an attacker needs to puppeteer your supply chain.

Incident Summary

CVE ID / Incident:	Cordyceps CI/CD Vulnerability Class (Novee Security, June 24, 2026)
Affected Systems:	GitHub Actions workflows at Microsoft, Google, Apache, Cloudflare, Python Software Foundation, and 300+ confirmed vulnerable repositories
Disclosure Date:	June 24, 2026
Patch Status:	Confirmed fixes applied by Microsoft, Google, Apache, Cloudflare, and Python Software Foundation; ongoing hardening recommended for all GitHub Actions users

References

1. Novee Security, “Cordyceps: The Silent Parasite Consuming Your Supply Chain,” June 24, 2026, https://novee.security/blog/cordyceps/ (accessed June 24, 2026).
2. The Hacker News, “Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks,” June 24, 2026, https://thehackernews.com/2026/06/cordyceps-cicd-flaws-expose-300-github.html (accessed June 24, 2026).
3. GitHub Docs, “About Pull Requests,” https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-pull-requests (accessed June 24, 2026).