Poisoned Pipeline / Techniques / T0104

T0104 · Reconnaissance · TA01 · observed in 1 incident(s)

Discover coding flaws

This technique involves identifying coding flaws in an application's codebase, including vulnerabilities such as buffer overflows, race conditions, injection flaws, and other software bugs that can be exploited by attackers to gain unauthorized access or cause system disruption.
An attacker can use this technique to gain insight into potential weaknesses in the application's codebase and identify attack vectors that can be exploited in future attacks.
By discovering coding flaws in an application, an attacker can develop a better understanding of the application's architecture and potential vulnerabilities.

Where this idea came from

Public incident / advisory

Wiz chained three Artifactory vulnerabilities; Antrea and Nx incidents exploited known CI/CD flaws. Also GitHub secure-code guidance.

• https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
• https://docs.github.com/en/code-security/supply-chain-security/end-to-end-supply-chain/securing-code

Mitigations

• M1720 Implement regular patches and updates
• M1730 Implement code reviews
• M1732 Implement code scanning for security risks

Detections

• D1170 Configure application audit logs to detect injection attacks
• D1260 Implement regular security audit and review
• D1261 Implement penetration testing
• D1262 Implement vulnerability assessment
• D1500 Configure monitoring of used artifacts and open-source libraries
• D1510 Implement Intrusion Detection System and anti-malware

Observed in incidents (1)

• In-the-wild JFrog Artifactory auth bypass (CVE-2026-42016/42018/82329)

References

• https://docs.github.com/en/code-security/supply-chain-security/end-to-end-supply-chain/securing-code