Cordyceps Supply chain Vulnerability Impacting Code Repositories at thousands of Organizations

Gbhackers •Mayura Kathir • June 23, 2026

A pervasive CI/CD vulnerability pattern dubbed “Cordyceps” reveals a supply chain vulnerability that lets unauthenticated attackers seize control of Git-based workflows and, by extension, the software artifacts they produce. The issue is not a single bug in GitHub or any one tool; it is a systemic class of insecure workflow compositions. Command injection, broken authentication […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cordyceps Vulnerability Exposes Thousands of Code Repositories to Attacks A newly identified supply chain vulnerability named 'Cordyceps' affects CI/CD workflows across major platforms, allowing unauthenticated attackers to exploit Git-based repositories. Novee's research flagged 654 vulnerable repositories, with over 300 confirmed as fully exploitable. The vulnerability arises from insecure workflow compositions, enabling command injection, credential theft, and privilege escalation. Affected systems include Microsoft's Azure Sentinel, Google's AI Agent Development Kit, Apache's Doris, Cloudflare's Workers SDK, and the Python Software Foundation's Black project. Major companies have confirmed the vulnerability and implemented fixes, but the potential impact could extend to millions of repositories. The flaw's systemic nature highlights the need for enhanced security measures in CI/CD configurations. 13 sources 72

Extracted Entities

Cordyceps Supply chain Vulnerability Impacting Code Repositories at thousands of Organizations

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)