● Covered by 2 sources · 2 reportsMedium impact
Cordyceps Vulnerability Exposes Over 300 GitHub Repositories to Supply-Chain Attacks
Key points
- Cordyceps is a CI/CD vulnerability identified by Novee Security.
- Affects over 300 GitHub repositories, including Microsoft and Google projects.
- The flaw enables unauthenticated code execution and credential theft.
- Scanned 30,000 repositories; many remain exploitable.
- Weak CI/CD configurations allow excessive permissions for pull requests.
Overview of the Vulnerability
Novee Security has discovered a critical CI/CD vulnerability, termed Cordyceps, affecting over 300 repositories on GitHub. The flaw allows attackers to gain full control over these projects, posing significant risks to software supply chains.
Details of the Exploit
The vulnerability emerges from inadequate configurations in CI/CD workflows, specifically with GitHub Actions. This setup enables attackers to push malicious code without needing special permissions—only a free GitHub account is required. Such compromised projects belong to major players like Microsoft, Google, and Apache.
Technical Root Cause
The issue stems from excessive permissions granted to pull requests in CI/CD configurations. These configurations mistakenly provide more privilege than intended, facilitating unauthorized actions by attackers.
Implications and Concerns
The widespread impact means critical open-source supply chains are at significant risk. Security scanners failed to detect this threat as standard checks marked pipelines as secure. This oversight underscores the need for improved workflow security and configuration hygiene in CI/CD pipelines.
Conclusion and Call to Action
With over 300 repositories confirmed vulnerable out of 30,000 scanned, the Cordyceps flaw is a significant concern for all organizations relying on GitHub for CI/CD processes. It calls for immediate review and tightening of repository permissions and configurations to prevent potential attacks.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Novee Security disclosed a new CI/CD attack pattern called Cordyceps, exposing 300 vulnerable repositories across major platforms. This vulnerability exploited GitHub Actions workflows, bypassing standard security checks and allowing potential attackers to execute harmful code without detection.
Researchers identified a CI/CD vulnerability, codenamed Cordyceps, affecting over 300 repositories on GitHub. This flaw allows unauthenticated users to hijack workflows, posing significant risks to the supply chain of major organizations like Microsoft and Google.