Poisoned Pipeline / Incidents / AS79
CNCF Antrea Jenkins slash-command credential theft
Git / GitHubJenkinsGitHub Actions
On 2 May 2026 throwaway 0xedgerunner opened antrea PR 8027, posted five
/test-* slash commands in three seconds, and iterated 19 commits that
planted a Jenkins Job DSL Python-eval gadget plus bash credential
scrapers. OSM: the public jenkins.antrea.io UI plus unauthenticated
slash-command jobs let the PR author run fork code on self-hosted
Jenkins; the payload probed the controller at 35.164.122.165, IMDSv2,
and dumped secrets to paste.rs / webhook.site. Commits spoofed
CI Bot <ci@antrea.io>. Maintainer closed it as credential exfil; the
operator claimed root on the controller. Distinct from the March Trivy
window (AS17); Antrea maintainers said they were not hit then.
Mapped techniques
- T0147 Scan public CI/CD configurations for secrets and vulnerable actions
- T0166 Trigger pipeline execution
- T0118 Command injection
- T0195 Spoofed Commits
- T0140 Harvest tokens from environment variables
- T0156 Exfiltration over webhooks
supply-chain slash-command jenkins detonation
Public Jenkins UI and slash-command CI mapped without auth.
Five /test-* comments on a fork PR ran Jenkins jobs.
Job DSL !!python/object/apply:eval gadget in 000_payload.yaml.
Author set to CI Bot ci@antrea.io, unverified on the throwaway account.
Env, docker/kube/aws/gcloud creds, Jenkins store, IMDSv2.
paste.rs and webhook.site collectors.