‘Cordyceps’ exploit exposes crumbling trust in GitHub actions, sparking CI/CD security reckoning

Kaspersky's comprehensive audit of over 130,000 GitHub Actions workflows across 30,000 popular repositories uncovered a staggering 250,000 potential security misconfigurations, revealing that only 10% of repositories were free from alerts. This widespread prevalence underscores systemic vulnerabilities in CI/CD pipelines, with issues ranging from low to critical risk levels, highlighting a pervasive challenge in securing automated development environments.

While the majority of identified misconfigurations—approximately 60% low risk and 40% medium risk—may not be immediately exploitable, Kaspersky's analysis flagged around 200 repositories as high risk, including eight with critical flaws capable of enabling devastating software supply chain attacks. These critical vulnerabilities span diverse domains such as AI integration and security testing tools, emphasizing the urgent need for targeted remediation in high-impact projects.

Common security pitfalls in GitHub Actions workflows include overly broad access permissions, missing dependency version pinning, and insecure workflow-level configurations. These misconfigurations collectively expand the attack surface, potentially allowing malicious actors to inject code, gain unauthorized access to infrastructure keys, or compromise automated deployment processes, effectively turning trusted CI/CD pipelines into attack vectors.

Kaspersky stresses that although not all misconfigurations translate directly into exploitable vulnerabilities, their early detection is vital for strengthening CI/CD security posture. Leonid Bezvershenko of Kaspersky advises developers to proactively verify and harden their workflow configurations, while Kaspersky’s Container Security platform offers scanning tools to help organizations identify and remediate these issues before they can be leveraged in supply chain attacks.

The Cordyceps exploit exposes a critical blind spot in conventional CI security scanners, which are designed to analyze individual files rather than the intricate interplay of GitHub Actions workflows. As these scanners rely on pattern-matching well-formed YAML files, they fail to detect vulnerabilities that emerge only through the composition of multiple workflows, allowing malicious sequences to pass unnoticed.

By exploiting specific GitHub Actions triggers such as pull_request_target and workflow_run, attackers can chain together multi-step workflows that run with elevated privileges, enabling command and code injection alongside cross-workflow privilege escalation. This complex attack pattern, dubbed the 'pwn request' by GitHub Security Lab, highlights how the vulnerability lies not in any single workflow but in their combined execution, effectively bypassing traditional security measures.

Remarkably, the Cordyceps exploit requires only a free GitHub account, with no need for organizational membership or elevated permissions, to gain unauthorized and persistent write access to sensitive security assets. For instance, in Microsoft's Azure Sentinel repository, an attacker could execute anonymous code via a pull request comment and steal a non-expiring GitHub App key, underscoring the severe risk posed by this seemingly low-barrier attack vector.

At the heart of Cordyceps lies a fundamental trust boundary misconfiguration where workflows inadvertently treat untrusted pull request inputs as if they originated from trusted maintainers. This oversight, often unintentional and unreviewed, creates a dangerous assumption of trust that attackers exploit, emphasizing the urgent need for engineering leaders to audit and redefine trust boundaries within their CI/CD pipelines.

By early 2026, cybersecurity experts have crystallized a critical truth: trust without continuous validation has become one of the largest attack surfaces in enterprise CI/CD pipelines. Traditional static trust models, which rely on past approvals and quarterly patch cycles, are no longer sufficient in an environment where attackers exploit vulnerabilities within days of disclosure. As highlighted by Huntress’s documentation of 81 million password spray attempts bypassing MFA through legacy Microsoft OAuth flows, organizations must shift from complacency to continuous verification to close these rapidly emerging gaps.

Governance failures, rather than purely technological shortcomings, have emerged as the primary enablers of cyberattacks within CI/CD workflows. Attackers exploit overlooked paths such as mismatched patch cadences, legacy authentication flows, and unvalidated AI agent inputs—demonstrating that these breaches are not defeats of sophisticated defenses but lapses in governance. This shift underscores the imperative for organizations to enforce stricter controls and ongoing validation, recognizing that cybersecurity now demands governance to be as robust as technology itself.

The rise of AI coding agents as privileged identities within CI/CD environments introduces a new frontier of risk that demands zero-trust security architectures and least privilege frameworks akin to those protecting production systems. With AI agents having broad access to repositories, cloud credentials, and local filesystems, vulnerabilities such as Cursor IDE’s zero-click exploits illustrate how a developer opening a repository can lead to full workstation compromise without any user interaction. Organizations that proactively apply zero-trust principles to AI development environments will avoid the operational failures that others are only beginning to uncover.