Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking

Cybersecurity researchers at Novee have recently identified a critical set of vulnerabilities, collectively termed "Cordyceps," affecting continuous integration/continuous delivery (CI/CD) pipelines within the open-source software supply chain. These systemic flaws pose a significant threat, potentially allowing unauthenticated attackers to take complete control of millions of software repositories. The core issue stems from various security defects, including command injection and authentication bypasses, which enable malicious actors to manipulate developer workflows. An attacker, even without specific organizational membership or elevated privileges, can exploit these weaknesses to forge code approvals, push unauthorized code to protected branches, and steal sensitive credentials from cloud environments like AWS, GCP, and Netlify. This could lead to widespread supply chain compromises through the distribution of malicious packages via platforms such as NPM, PyPI, Docker, and Helm. Novee's research highlights that the rapid adoption of "agentic coding" practices has inadvertently contributed to this problem. These practices, which involve automated code generation for CI/CD workflows, have led to the replication of insecure patterns across a vast number of repositories. This means that vulnerabilities, once introduced, are quickly propagated, amplifying the potential impact of an attack. The firm's initial scans identified 654 potentially vulnerable repositories, with over 300 confirmed as fully exploitable, demonstrating the scale of the threat. The implications are far-reaching, as many prominent platforms and tools, including Microsoft's Azure Sentinel, Google's AI Agent Development Kit, Apache Doris, and Cloudflare's Workers SDK, have been confirmed to be impacted. Organizations that depend on these tools are now at risk of supply chain attacks, where compromised components could introduce backdoors or other malicious functionalities into their software. This discovery underscores the urgent need for enhanced security measures within CI/CD environments and a more rigorous approach to open-source software supply chain security. Developers and organizations must prioritize auditing their CI/CD configurations, implementing stronger authentication mechanisms, and continuously monitoring their dependencies to mitigate the risks posed by such pervasive vulnerabilities. The ease with which an unauthenticated attacker can gain control highlights a fundamental weakness that requires immediate attention across the software development ecosystem.