Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks

Summary: Novee Security flagged a CI/CD workflow weakness it calls Cordyceps, which lets any unauthenticated user with a free account forge approvals, push code, or steal credentials in repositories at organizations including Microsoft, Google, Apache, and Cloudflare. A scan of about 30,000 high-impact repositories found more than 300 fully exploitable, with confirmed impact at Microsoft and Google and hardening or patches applied at Cloudflare, Python, and Apache.
What's compelling: More than 300 repositories across some of the largest open-source projects can be taken over by an anonymous user with a free account, and Novee notes the pattern hides from scanners because every individual piece is working as designed.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026