Loading story…
A critical misconfiguration in GitHub’s public actions/runner-images repository allowed pull requests from fork contributors to execute on persistent, non-ephemeral self-hosted runners between February and July 2023. A researcher bypassed contributor-status controls, achieved arbitrary code execution on azure-builds and macos-vmware infrastructure, and demonstrated persistence by leaving processes running after workflow jobs completed.
Persistent access could have exposed secrets used by legitimate runner-image builds, including a write-capable GITHUB_TOKEN, vCenter credentials, and Azure build-process credentials. An attacker could plausibly have altered GitHub-hosted runner-image build code, tampered with image-generation infrastructure, moved laterally into GitHub or Azure build engineering environments, or pivoted into GitHub’s macOS private cloud. GitHub triaged the disclosure in July 2023, applied repository mitigations, resolved it as a critical misconfiguration in November, and awarded the researcher a $20,000 bounty; organizations using public repositories with self-hosted runners should require approval for all external contributors and use isolated, ephemeral runners.
Trace attribution and downstream blast radius.
8 events from the most recent confirmed update back to the earliest known activity.
GitHub resolved the report as a critical misconfiguration vulnerability and awarded the researcher a $20,000 HackerOne bug bounty.
The researcher removed the persistence mechanism from the affected self-hosted runner after maintaining access for five days.
GitHub acknowledged the report on July 24 and made initial repository mitigations on July 25. The researcher reported that GitHub's immediate fixes addressed the exposed runner configuration.
The researcher submitted the self-hosted runner misconfiguration vulnerability through HackerOne.
A minor typo-fix pull request from the researcher was merged, granting contributor status that bypassed the repository's default approval requirement for fork pull-request workflows.
GitHub's public actions/runner-images repository used non-ephemeral self-hosted runners for GitHub-hosted runner-image builds, with its exposed configuration spanning February through July 2023.
Praetorian researchers Adnan Khan and John Stawinski reported identifying thousands of potentially vulnerable public GitHub repositories using self-hosted runners and submitted more than 20 bug-bounty reports. Their research also assessed related risks affecting projects including PyTorch, Microsoft DeepSpeed, Cloudflare, blockchains, and TensorFlow, and expanded to Buildkite, Jenkins, and CircleCI.
Using contributor status and modified pull-request workflows, the researcher ran code on the azure-builds and macos-vmware runners, deployed persistence, and accessed build-job data including a write-capable GITHUB_TOKEN and clear-text macOS image-build secrets.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourceadnanthekhan.com
Open sourceadnanthekhan.com
Open sourcepraetorian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors compromised the popular GitHub Actions repositories `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` by moving version tags to imposter commits outside the normal commit history, causing workflows that referenced those tags to fetch and run malicious code. Researchers said the payload downloaded the **Bun** JavaScript runtime, read memory from the GitHub Actions `Runner.Worker` process to recover decrypted secrets, and exfiltrated the data over HTTPS to the attacker-controlled domain `t.m-kosche[.]com`; workflows pinned to a known-good full commit SHA were not affected. GitHub later disabled access to the repository for a terms-of-service violation, while StepSecurity added the action to its Compromised Actions Policy and blocked the exfiltration domain through Harden-Runner. The incident highlights a broader GitHub Actions supply-chain risk in which CI/CD trust can be subverted through mutable references and weak integrity controls. Separate research showed that a modified Maven wrapper in a pull request could achieve code execution on GitHub-hosted runners and, if merged, later expose release secrets such as Maven publishing credentials and GPG material, underscoring the need for checksum validation on wrapper scripts and immutable pinning to trusted commit SHAs for third-party actions. StepSecurity also linked the same exfiltration infrastructure to the recent **Mini Shai-Hulud** activity targeting npm packages in the `@antv` ecosystem, suggesting the GitHub Actions compromise may be part of a wider supply-chain campaign.
Jun 29, 2026
The **GhostAction** supply-chain campaign compromised 327 GitHub users and inserted malicious workflows into 817 repositories, stealing 3,325 CI/CD secrets. Workflows masquerading as “Github Actions Security” sent PyPI, npm, DockerHub, GitHub, AWS, database, and Cloudflare credentials by HTTP POST to attacker infrastructure, including `45.139.104.115`; a later wave added exfiltration domains and hundreds of commits. Although no malicious package releases had been confirmed at disclosure, 24 affected packages—nine npm and 15 PyPI—remained at immediate risk, while some stolen credentials were reportedly already abused. CI/CD workflows are also vulnerable to remote-code-execution exposure from unsafe `pull_request_target` configurations, artifact-token leaks such as **ArtiPACKED**, and attacks including **HackerBot-Claw**. Elastic Security Labs released the open-source `cicd-abuse-detector` to review GitHub Actions, GitLab CI, and Azure DevOps changes before merge or deployment, extracting more than 50 signals from pipeline files and analyzing diffs for secret exfiltration, privileged pull-request triggers, permission escalation, self-hosted-runner targeting, supply-chain manipulation, and timestamp abuse. The tool can issue pull-request, issue, Slack, and Elasticsearch alerts and optionally block risky pull requests.
Sep 9, 2026
GitHub awarded researcher Saif Ghani a **$100,000** bug bounty for reporting `CVE-2026-3854`, a critical remote-code-execution vulnerability in its Git push processing pipeline. The flaw reportedly enabled an unauthenticated attacker to supply a specially crafted repository URL during Git-related operations and execute arbitrary commands on GitHub backend infrastructure. GitHub said it deployed mitigations shortly after receiving the report and completed a patch rollout through coordinated disclosure before detailed exploitation information became broadly available. Exploitation could have threatened public and private repository integrity, source-code confidentiality, Git objects, secrets and credentials, build workflows, and the wider software supply chain.
Sep 14, 2026