Security researchers at Novee have disclosed a new CI/CD vulnerability class called 'Cordyceps' that allows attackers to exploit malicious pull requests against insecurely configured automated workflows. A scan of public repositories found 654 potentially vulnerable projects, with ~300 confirmed fully exploitable. Affected projects include Microsoft Azure Sentinel, Google's AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and the Python Black formatter. The weakness stems not from pull requests themselves but from workflow configurations that grant excessive privileges to untrusted inputs, enabling credential theft, command injection, and malicious package publishing. Notably, AI-generated CI/CD configs may amplify the problem by replicating insecure patterns at scale. Recommended mitigations include auditing workflows for excessive permissions, applying least-privilege principles, and treating workflow YAML with the same rigor as application code.
