Unseen Threat: GitHub Actions Attack Pattern Bypasses CI Security Scanners

The promise of continuous integration and continuous delivery (CI/CD) is speed and reliability, but what if your automated security checks are giving you a false sense of security? Recent research has revealed a sophisticated attack pattern in GitHub Actions that skillfully bypasses conventional CI security scanners, leaving critical projects exposed even when their dashboards flash green.

What Happened

In June 2026, Novee Security researchers unveiled a new class of CI/CD weaknesses they dubbed "Cordyceps." Their extensive scan of approximately 30,000 high-impact repositories across major ecosystems like npm, PyPI, crates.io, and Go identified 654 potential targets, with over 300 confirmed as fully exploitable. Alarmingly, these included projects from tech giants such as Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation.

The core of the vulnerability lies in specific GitHub Actions triggers: pull_request_target and workflow_run. Unlike pull_request, which runs in the untrusted context of a fork with read-only tokens and no secrets, these problematic triggers execute in the base repository's context, granting them access to sensitive secrets and a read-write GITHUB_TOKEN. This elevation of privilege allows an attacker to induce these workflows to act on malicious content originating from a pull request.

Novee Security identified three primary primitives for exploitation:

1. Command Injection: Attacker-controlled data (e.g., from a branch name, pull request title, or comment) is interpolated unescaped directly into a shell command within a run step, leading to arbitrary code execution.
2. Code Injection: Utilizing actions/github-script, attacker input is evaluated as JavaScript at runtime, enabling malicious script execution.
3. Cross-Workflow Privilege Escalation: A low-privilege workflow is tricked into writing untrusted data into an artifact or output. A subsequent, higher-privilege workflow then reads and acts on this data with the maintainer's elevated token.

Crucially, standard static application security testing (SAST) and dynamic application security testing (DAST) tools are blind to this threat. As Shane Warden, Principal Architect at ActiveState, explains, "A scanner sees a workflow. An attacker sees a four-step chain to a permanent credential." Each individual workflow file is perfectly valid YAML, performing exactly as instructed. The danger isn't in a single line of code but in the dangerous composition and interaction between different workflow steps and how they handle untrusted input, a sophisticated flaw that single-file scanners are not designed to detect.

One particularly stark demonstration involved Microsoft's Azure Sentinel repository. Novee researchers showed that a simple comment on a pull request could be leveraged to execute anonymous attacker code on Microsoft's CI infrastructure and steal a non-expiring GitHub App key. This was confirmed by Microsoft's Security Response Center. Given that Azure Sentinel's Content Hub delivers detection rules and automated playbooks directly to customer workspaces, a stolen key could grant persistent write access to critical security content, potentially allowing attackers to quietly weaken the security posture of thousands of organizations downstream.

ActiveState GitHub Actions article: image omitted due to site embedding policy; open the original article (BleepingComputer) (opens in a new tab) to view it. Photo/source: BleepingComputer (opens in a new tab).

Why It Matters

This Cordyceps attack pattern represents a significant challenge to modern software supply chain security. For developers and IT teams, it highlights a critical blind spot in existing CI/CD security practices. The reliance on SAST/DAST tools to give a definitive 'green light' is profoundly misleading in this context. A green pipeline is not necessarily a governed or secure one when compositional vulnerabilities like Cordyceps are at play.

The implications are broad:

• False Sense of Security: Organizations may believe their CI/CD pipelines are secure due to passing scanner results, while critical vulnerabilities remain hidden.
• Supply Chain Risk: The ability to inject malicious code or modify security content directly into widely distributed projects, as demonstrated with Azure Sentinel, poses a severe threat to the integrity of the software supply chain. Attackers could subtly degrade security features, introduce backdoors, or exfiltrate data from downstream users.
• Credential Theft and Persistence: The exploit's ability to steal non-expiring credentials provides attackers with persistent access, making detection and remediation far more challenging.
• Impact on Open Source: Given the reliance of many projects on GitHub Actions and the open nature of pull requests, the vulnerability has a wide attack surface, particularly for popular open-source projects.

This vulnerability underscores the growing complexity of securing modern development workflows, especially with the rise of “agentic coding,” where automated processes interact with potentially untrusted external inputs. The gap between what our security tools can see and the sophisticated attack chains being developed is widening, demanding a more holistic and contextual approach to CI/CD security.

What To Watch

Organizations must move beyond simplistic file-based scanning and adopt a more sophisticated understanding of their CI/CD security posture. Key areas to focus on include:

• Contextual Analysis: Invest in tools and practices that can analyze the full context of a workflow's execution, including how different steps interact and how external inputs are handled.
• Principle of Least Privilege: Strictly review and limit the permissions granted to pull_request_target and workflow_run triggers, ensuring they only have the minimum necessary access.
• Input Sanitization and Validation: Implement rigorous sanitization and validation for all external inputs (e.g., pull request titles, branch names, comments) that are used within shell commands or scripts in workflows.
• Workflow Auditing: Conduct regular, manual or tool-assisted audits of GitHub Actions workflows to identify potential compositional vulnerabilities.
• Supply Chain Security Platforms: Explore specialized supply chain security platforms that offer deeper analysis into the interactions and dependencies within CI/CD pipelines.

The Cordyceps vulnerability is a stark reminder that true security requires understanding not just individual components, but their dynamic interplay. As our CI/CD pipelines grow more complex, so too must our strategies for defending them.