Poisoned Pipeline / Techniques / T0147
Scan public CI/CD configurations for secrets and vulnerable actions
CI/CD Posture
This technique involves scanning publicly available CI/CD configurations for potential vulnerabilities, misconfigurations, and secrets.
An attacker can use this technique to identify misconfigured CI/CD pipelines that may contain secrets or other sensitive information, such as API keys or login credentials.
They can also identify vulnerable actions, such as unsecured build agents or outdated software components, that can be exploited to gain access to an organization's infrastructure or data.
Misconfigured or insecure CI/CD pipelines can introduce significant security risks, including data breaches and system compromise.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://owasp.org/www-project-top-10-ci-cd-security-risks/
- https://www.aquasec.com/cloud-native-academy/supply-chain-security/ci-cd-security-threats-tools-and-best-practices/
- https://cycode.com/github-actions-vulnerabilities/
Mitigations
- M1120 Store credentials in vault
- M1201 Restrict egress traffic in CI/CD
- M1660 Isolate pipeline for unreviewed code
- M1662 Evaluate pipeline execution permissions
- M1720 Implement regular patches and updates
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system
- D1590 Implement continuous monitoring and logging of the CI/CD process
Observed in incidents (9)
- GhostAction steals CI secrets, then autoruns a stealer from a fake font
- tj-actions/changed-files GitHub Action
- GitHub Actions abuse for cPanel/WHM exploitation
- @7nohe/openapi-react-query-codegen poisoned publish workflow
- hackerbot-claw autonomous GitHub Actions exploitation
- TanStack Mini Shai-Hulud (CVE-2026-45321)
- Megalodon mass GitHub repo backdooring via CI
- CNCF Antrea Jenkins slash-command credential theft
- prt-scan 219 malicious PRs stealing CI secrets