10 real-world stories of how we've compromised CI/CD pipelines
Examples include exploiting S3 misconfigurations, Jenkins plugin flaws, GitLab runner privilege escalations, Kubernetes pod annotation vulnerabilities, and compromised developer laptops.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
Malicious code analysis: Abusing SAST (mis)configurations to hack CI systems medium.com
Misconfigured SAST tools can be exploited to execute malicious code on CI systems, allowing attackers to steal credentials or deploy malicious artifacts.
-
Living off the pipeline github.com
Inventory how development tools (typically CLIs), have lesser-known RCE-By-Design features.
-
Holes in Your Bitbucket: Why Your CI/CD Pipeline Is Leaking Secrets cloud.google.com
Bitbucket Secured Variables leak secrets via artifact objects; recommendations include using dedicated secrets managers and code scanning.
-
How We Discovered Vulnerabilities in CI/CD Pipelines of Popular Open-Source Projects cycode.com
Extracting all repository and organization secrets in GitHub Actions.
-
Common Threat Matrix for CI/CD Pipeline github.com
-
Hacking GitHub AWS integrations again dagrz.com
Attacking misconfigured pipelines that use OIDC.
CI/CD Attacks › Case Studies: “Examples include exploiting S3 misconfigurations, Jenkins plugin flaws, GitLab runner privilege escalations, Kubernetes pod annotation vulnerabilities, and compromised developer laptops.”