Inadequate CI/CD workflow permissions

CI/CD Posture SCM Posture Secrets Hygiene

Pipelines that grant overly broad tokens (for example GitHub Actions
GITHUB_TOKEN with contents: write, id-token: write, or pull-request
jobs that can push to default branches) let an attacker persist after the
first poisoned workflow run. Persistence takes the form of a new workflow
file, a deploy key, a self-hosted runner registration, or a long-lived
cloud credential minted by the job. This is distinct from overprivileged
runners (T0132) and from creating an access token after account takeover
(T0165): the weakness is the workflow permission set itself.

Where this idea came from

Standard or guidance

This catalogue, from upstream issue #42 and OWASP CICD-SEC-5 (pipeline-based access controls).

Mitigations

M1220 Use only trusted third-party Github actions from reputable sources
M1221 Review the Github action source code
M1222 Limit the permissions granted to third-party Github actions
M1120 Store credentials in vault

Detections

D1260 Implement regular security audit and review
D1261 Implement penetration testing
D1590 Implement continuous monitoring and logging of the CI/CD process

Inadequate CI/CD workflow permissions

Where this idea came from

Mitigations

Detections

Observed in incidents (8)

References