Poisoned Pipeline / Techniques / T0183
Harvesting short-lived token
This attack technique involves searching for short-lived tokens that are used during the CI/CD process and extracting them for later use in unauthorized activities.
Short-lived tokens are often used in CI/CD systems to authenticate communication between different components, such as the build server and the deployment server.
An attacker can obtain these tokens from CI/CD logs, variable groups, secure files, etc.
These tokens typically have a limited lifespan, but if an attacker is able to capture them, they can use them to gain unauthorized access to the system or associated resources.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below. DEF CON 32: OH-MY-DC, leaked CI OIDC token to cloud (Hahami).
- https://www.synacktiv.com/en/publications/cicd-secrets-extraction-tips-and-tricks.html
- https://defcon.org/html/defcon-32/dc-32-speakers.html#54494
Mitigations
- M1120 Store credentials in vault
- M1830 Restrict token access
Detections
- D1590 Implement continuous monitoring and logging of the CI/CD process
Observed in incidents (5)
- Stolen GitHub tokens planted a secret-dumping workflow in 850+ accounts and pulled the logs back through the API
- actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement
- @subql/common 5.8.3 published after a CI artifact swap
- @7nohe/openapi-react-query-codegen poisoned publish workflow
- TanStack Mini Shai-Hulud (CVE-2026-45321)