Cordyceps Flaw Class Hands Attackers the Keys to 300+ GitHub Repos
A newly catalogued CI/CD weakness lets attackers hijack workflows at Microsoft, Google and Apache projects, Novee Security says.
Key points
- Novee Security has named a new class of GitHub Actions weakness Cordyceps, affecting 300-plus repositories.
- Microsoft, Google and Apache are among the organisations listed in the disclosure.
- The pattern is structural, not a single CVE, so each affected project needs its own fix.
- Attackers who exploit it can gain repository write access or extract pipeline secrets.
- Novee says it is coordinating remediation with affected vendors; project-level advisories are expected in sequence.
Researchers at Novee Security have named a new class of CI/CD (continuous integration and delivery) workflow weakness Cordyceps, and the disclosure list reads like a who's who of the open-source world.
Microsoft. Google. Apache. More than 300 repositories at some of the largest organisations on the planet are affected, according to the disclosure.
What is the Cordyceps flaw?
Cordyceps is not a single CVE. It's a structural flaw in how GitHub Actions and similar pipelines hand trust to inputs attackers can manipulate: pull request titles, branch names, issue bodies, untrusted forks. When a workflow consumes that input without sanitisation and runs with privileged tokens, an attacker can execute arbitrary code inside the pipeline and leave with repository write access or secrets.
Novee describes it as a "critical exploitable pattern" rather than a single bug, which matters for triage. There is no central patch.
Why does this fit the supply-chain threat?
The abuse path is familiar to anyone tracking supply-chain incidents. Compromise a maintainer's pipeline, push a poisoned commit or release artifact, and the malicious payload ships downstream to every consumer of that package. Our 4 June report on a bug in Anthropic's Claude Code GitHub Action showed how a single issue-triage step can become arbitrary code execution. The 2024 XZ Utils backdoor showed how patient an attacker can be. Cordyceps lowers the patience requirement.
Should you worry?
Neither Novee nor the affected projects have published a full list of the 300-plus repositories at time of writing. Coordinated disclosure is ongoing. GitHub's own guidance on securing workflows against script injection lives here and remains the baseline reference for maintainers auditing their pipelines.
If you run Actions workflows, check four things:
- Any step that interpolates
${{ github.event.* }}values directly into arun:block. That's the canonical injection sink. pull_request_targettriggers combined with checkout of untrusted code. This combination has burned multiple high-profile projects already.- Workflow permissions left at the default
write-allinstead of scoped per job. - Third-party Actions pinned by tag rather than commit SHA.
CI/CD systems were built for developer convenience, then quietly became the most privileged execution environment in most organisations. They hold cloud credentials, signing keys, production deploy rights. Treating them as build tooling rather than protected infrastructure is how supply-chain compromises keep happening. Cordyceps is the sixth GitHub Actions story Threat Vectr has covered in the last 90 days, and the pattern does not look like it's narrowing.
Novee says it is working with affected vendors on remediation. Expect a steady drip of project-level advisories rather than a single coordinated patch day.
Maintainers who suspect exposure: rotate any secrets accessible to your Actions runners before auditing the workflows. Rotate first, investigate second.
