Cordyceps: A Class of CI/CD Weakness
In June 2026, researchers at Novee Security disclosed a class of CI/CD weakness they named Cordyceps. This vulnerability allows attackers to exploit GitHub Actions workflows, even when security scanners report no issues.
The researchers scanned roughly 30,000 high-impact repositories across the npm, PyPI, crates.io, and Go ecosystems and found that 654 repositories were vulnerable, with more than 300 being fully exploitable. The affected build tooling included projects published by Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation.
The Vulnerability
The vulnerability exists in the composition of GitHub Actions workflows, rather than in a single file. An attacker can induce a workflow to act on attacker-controlled content from a pull request, allowing them to execute malicious code.
Three primitives are used to exploit this vulnerability: command injection, code injection, and cross-workflow privilege escalation. These primitives allow an attacker to inject malicious code into a workflow, execute it, and escalate privileges to gain access to sensitive data.
Real-World Examples
Novee Security demonstrated the exploitability of this vulnerability by showing how a comment on a pull request could run anonymous attacker code on Microsoft's CI and steal a non-expiring GitHub App key. Similar exploits were also demonstrated on Google's AI Agent Development Kit sample repository and Apache Doris.
These examples highlight the severity of this vulnerability and the need for organizations to take immediate action to protect themselves.
Closing the Gap
To close the gap, organizations should prefer pull_request over pull_request_target for untrusted contributions, never check out pull request head code inside a privileged workflow, pass event data through a quoted env variable rather than inlining it, default permissions to read-only, pin third-party actions to a commit SHA rather than a moving tag, and gate privileged workflows behind manual approval for first-time contributors.
However, these fixes only address the current problems and do not prevent future vulnerabilities. The durable control is to govern what your build can trust at the source, so the components and workflows entering your pipeline come from a governed origin with verifiable provenance, built from source rather than trusted on faith.
The Role of AI-Driven Development
AI-driven development is widening the software supply chain governance gap, and it's accelerating. The leverage is real, and it's not arguing to slow it down. However, the volume of workflow decisions an organization now absorbs has outrun a review process sized for human-speed output.
Our standard security systems aren't ready for this either. Cordyceps is not a CVE, so it never enters the enumeration model. Furthermore, NIST acknowledged in April 2026 that it can no longer enrich every CVE, with submissions up 263% since 2020.
Conclusion
A green pipeline is not a governed one. The number stayed green while the thing it was supposed to guarantee stopped being true, if it was ever true at all. Those pipelines were not exposed because the scanners failed. They were exposed because passing the scan didn't mean they were governed. For a while, nobody went looking. Find out what's really running through yours.
A scanner sees a workflow. An attacker sees a four-step chain to a permanent credential.
Source: BleepingComputer