GitHub Actions “Cordyceps” Attack Pattern Bypasses CI Security Scanners
What Happened – Researchers at Novee Security identified a new CI/CD attack pattern, dubbed Cordyceps, that exploits the interaction between pull_request_target and workflow_run triggers in GitHub Actions. By chaining low‑privilege and high‑privilege workflows, an attacker with only a free GitHub account can inject commands, execute arbitrary JavaScript, and elevate privileges to steal repository secrets—all while every individual workflow file passes conventional SAST/DAST scans.
Why It Matters for Compliance & Audit Readiness
- The scenario illustrates a classic control‑mapping gap: each file complies with static policies, yet the composition violates the intent of SOC 2 Change Management and System Operations controls.
- Continuous‑compliance programs must capture workflow provenance and cross‑workflow dependencies as audit evidence, not just file‑level results.
- Verisq’s Control Mapping capability can automatically surface these composition‑level risks and feed them into a defensible SOC 2 evidence repository.
Who Is Affected – Organizations that rely on GitHub Actions for build, test, or deployment pipelines across any industry (software vendors, fintech, healthcare SaaS, etc.).
Recommended Actions
- Map GitHub Actions trigger configurations to SOC 2 CC6.1 (Change Management) and CC7.1 (System Operations) controls.
- Enforce a policy that only approved, signed workflow files may use
pull_request_targetorworkflow_run. - Integrate a CI/CD provenance collector that records workflow execution graphs for continuous audit evidence.
Source: BleepingComputer
Technical Notes
- Attack vector: misconfiguration of GitHub Actions triggers (
pull_request_target,workflow_run). - No CVE; the weakness is architectural—valid YAML files combined in a malicious sequence.
- Exploits command injection, JavaScript code injection via
github-script, and cross‑workflow privilege escalation.
Source: same as above