Researchers at Novee Security have identified a new class of CI/CD workflow weakness they've dubbed Cordyceps. This critical exploitable pattern, flagged by the cybersecurity firm, enables unauthenticated users to seize control of repositories, threatening the open-source software supply chain.
The vulnerability affects over 300 GitHub repositories, with potential impacts at dozens of the world's largest organizations such as Microsoft, Google, and the Apache Software Foundation. While the full scope remains unclear, the active exploitation status has not been confirmed by all sources.
Technical details are sparse, but the flaw allows attackers to hijack CI/CD workflows without authentication. The attack vector involves exploiting misconfigurations in continuous integration and delivery pipelines, granting full repository takeover capabilities.
No patches or specific mitigations have been publicly announced as of the latest reports. Organizations are advised to audit their CI/CD configurations and restrict unauthenticated access to workflow triggers until vendor guidance emerges.
Attribution for the research points to Novee Security, which has conducted this analysis independently. The broader threat landscape suggests similar weaknesses may exist across other CI/CD platforms, warranting further investigation.