OH-MY-DC: OIDC Misconfigurations in CI/CD
Summary: Unit 42 researchers investigating OpenID Connect use in CI/CD environments found misconfigurations, including one in CircleCI's OIDC implementation, that threat actors could exploit to reach restricted resources. The analysis identified three key threat vectors, and the paper accompanies the "Oh-My-DC" presentation delivered at DEF CON 32 in August 2024.
What's compelling: Because the CI/CD vendor acts as the identity provider, any customer of the same vendor can obtain machine-identity tokens bearing the vendor's signature, so authorization policy is the only control standing between another customer's runner and your cloud resources.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026