Supply Chain Attack on GitHub Action Exposes CI/CD Credentials

Severity: High (Score: 67.5)

Sources: Thehackernews, Cybersecuritynews, Gbhackers

Published: 2026-05-19 · Updated: 2026-05-20

Keywords: attack, github, compromised, action, credentials, supply, chain

Severity indicators: supply chain compromise, supply chain, credentials

Summary

A supply chain attack has compromised the GitHub Action 'actions-cool/issues-helper', exposing sensitive CI/CD secrets. The attacker manipulated Git tags, redirecting them to an imposter commit (1c9e803) without altering the visible commit history. This method allows the attacker to gain access to workflow credentials, potentially affecting numerous repositories that utilize this action. The incident highlights vulnerabilities in CI/CD processes and the importance of securing third-party integrations. As of now, the full scope of the impact is still being assessed, but users are advised to review their workflows for potential exposure. Key Points: • The GitHub Action 'actions-cool/issues-helper' was compromised in a supply chain attack. • Attackers redirected Git tags to an imposter commit to steal CI/CD credentials. • Users are urged to review their workflows for potential exposure to this vulnerability.

Detailed Analysis

**Impact** The attack affects users of the widely adopted GitHub Action, actions-cool/issues-helper, potentially exposing CI/CD credentials across multiple organizations relying on this workflow automation. The compromise risks unauthorized access to build and deployment pipelines, leading to operational disruption and data breaches. No specific sectors, geographies, or numbers of affected entities were provided. **Technical Details** The attacker manipulated Git tags by redirecting all release tags to an “imposter commit” (commit ID 1c9e803), enabling exfiltration of CI/CD secrets to an attacker-controlled domain. This supply chain attack targets the software development lifecycle at the build and deployment stage. No malware names, CVEs, or additional infrastructure details were disclosed. Indicators of compromise include the imposter commit hash 1c9e803 and network connections to the attacker domain. **Recommended Response** Immediately audit and revoke exposed CI/CD credentials associated with the affected GitHub Action. Validate and restrict Git tag permissions to prevent unauthorized tag manipulation. Monitor for unusual Git tag changes and network traffic to unknown domains from CI/CD environments. No patches were specified; continuous validation of CI/CD workflows is advised to detect similar supply chain compromises.

Source articles (3)

• Compromised GitHub Action Steals Workflow Credentials — Gbhackers · 2026-05-19
  A widely used GitHub Action, actions-cool/issues-helper, has been compromised in a supply chain attack that exposes sensitive CI/CD secrets to an attacker-controlled domain. The attack hinges on a sub…
• Compromised GitHub Action Exfiltrates Workflow Credentials to Attacker Domain — Cybersecuritynews · 2026-05-19
  A widely used GitHub Action called actions-cool/issues-helper has been compromised, with every version tag in the repository silently redirected to a malicious commit. The attack places stolen CI/CD p…
• GitHub Actions Supply Chain Attack Redirects Tags to Steal CI/CD Credentials — Thehackernews · 2026-05-19
  Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points. Learn how to validate real attack paths and reduce exploitable risk with continuous age…

Timeline

• 2026-05-19 — GitHub Action compromised: The 'actions-cool/issues-helper' GitHub Action was found to be compromised, exposing sensitive CI/CD secrets.
• 2026-05-19 — Attack method revealed: The attack utilized a manipulation of Git tags to redirect them to an imposter commit, allowing credential theft.

Related entities

• Supply Chain Attack (Attack Type)
• CWE-200 - Exposure of Sensitive Information (Cwe)
• T1041 - Exfiltration Over C2 Channel (Mitre Attack)
• T1195 - Supply Chain Compromise (Mitre Attack)
• GitHub (Platform)
• GitHub Action (Tool)
• GitHub Actions (Tool)