Loading story…
Researchers reported a chain of vulnerabilities in Cloudflare Pages build infrastructure that enabled command injection through user-controlled build settings, exposing sensitive pipeline variables including a GitHub private key for the Pages integration application and Cloudflare API credentials. The key reportedly carried read/write access to repositories for 18,290 users that had authorized the app. Subsequent findings included a world-writable binary, PATH hijacking, Azure DevOps variable injection, and passwordless sudo for the pipeline user; from a container, accessible Docker socket access allegedly allowed creation of a privileged container and recovery of Azure DevOps tokens used to enumerate Pages projects and build history.
After Cloudflare re-architected the environment around GKE and gVisor, researchers found that build containers could still reach Kubernetes host services. An unauthenticated kubelet API on TCP port 10255 exposed /pods data, including pod environment variables such as GIT_CREDS; scanning the 10.124.0.0/16 range identified multiple similarly exposed hosts, creating potential cross-tenant credential exposure. Cloudflare reportedly remediated the command-injection issue within two days and later implemented network isolation to prevent pod-to-host communication, an essential control where Kubernetes NetworkPolicy-capable networking is used to restrict L3/L4 ingress and egress paths.
Trace attribution and downstream blast radius.
9 events from the most recent confirmed update back to the earliest known activity.
Cloudflare promptly remediated the Cloudflare Pages kubelet exposure after disclosure. The reported mitigation implemented network isolation, with prevention of pod-to-host communication identified as the more comprehensive control.
Scanning the 10.124.0.0/16 range found multiple hosts exposing equivalent unauthenticated kubelet data. The researchers reported this could allow a tenant build to retrieve Git credentials associated with other users or organizations.
While testing Cloudflare Pages' GKE and gVisor-based build environment, researchers found that build containers could reach host services, including an unauthenticated kubelet API on TCP port 10255. Its /pods endpoint exposed pod specifications and environment variables, including GIT_CREDS.
From root in the Docker-based build container, researchers found an accessible /var/run/docker.sock and used it to create a privileged container with host filesystem, process, network, and device access. They reported recovering Azure DevOps instance tokens from the escaped environment and using them to enumerate Pages project users and build-run history.
Researchers reported that a Cloudflare Pages project build-command setting could inject an Azure DevOps Pipelines task.setvariable command, causing a repository-hosted reverse shell to run as the AzureDevOps pipeline user.
Cloudflare applied fixes to previously reported vulnerabilities in its Cloudflare Pages build-orchestration code, according to the researchers.
After the command-injection fix, researchers found that pages-metadata-generator was world-writable and that attacker-controlled directories persisted in PATH. They reported that these conditions could execute code as the higher-privileged AzDevOps account, which had passwordless sudo access to root within the build container.
Cloudflare remediated the initially reported Cloudflare Pages command-injection issue within two days, according to the researchers.
Assetnote researchers identified command-injection flaws in the Cloudflare Pages CLONE_REPO and PUBLISH_ASSETS workflow stages through user-controlled root-directory and output-directory settings. The flaws enabled execution in pipeline contexts containing sensitive environment variables, including a GitHub integration private key and Cloudflare API tokens.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourceslcyber.io
Open sourceslcyber.io
Open sourcekubernetes.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026
Researchers at Novee disclosed **Cordyceps**, a class of systemic software supply chain flaws in GitHub Actions workflows that can let attackers hijack build and release pipelines through insecure trust-boundary crossings in CI/CD YAML configurations. The attack chains combine issues such as command injection, broken authentication logic, artifact poisoning, and privilege escalation across multiple workflows rather than a single misconfiguration. Novee said exploitation may require only a pull request or even a pull request comment from a free GitHub account, allowing low-privilege or unauthenticated attackers to execute malicious code, steal credentials, and potentially gain control of code repositories and connected cloud environments. After scanning roughly **30,000** high-impact repositories, Novee flagged **654** projects and verified more than **300** as fully exploitable. Confirmed impact included repositories tied to **Microsoft, Google, Apache, Cloudflare,** and the **Python Software Foundation**, with examples including Azure Sentinel, Google `adk-samples`, Apache Doris, Black, and Cloudflare Workers tooling. The researchers said affected organizations have fixed the disclosed issues, but warned that AI coding agents are helping spread the same insecure CI/CD patterns across ecosystems including **npm, PyPI, crates,** and **Go**.
Jul 12, 2026
GitLab issued several security patch releases for Community Edition and Enterprise Edition to fix vulnerabilities affecting self-managed deployments, including two **critical pipeline impersonation flaws** that could let an attacker run CI/CD pipeline jobs as another user. The issues were tracked as `CVE-2024-5655` and `CVE-2024-6385`, with the latter included alongside fixes for group URL modification, deploy token creation, package registry manifest confusion, group member banning, and GitLab Pages subdomain takeover. GitLab said **GitLab.com** and **GitLab Dedicated** were already running patched versions and reported no evidence of abuse of `CVE-2024-5655` on GitLab-managed platforms. Subsequent patch releases addressed additional high- and medium-severity weaknesses, including stored cross-site scripting in Asciidoctor rendering (`CVE-2025-0314`), CI/CD variable exfiltration through CI lint (`CVE-2024-11931`), denial of service via cyclic epic references (`CVE-2024-6324`), access token exposure in logs, unauthorized issue status changes in public projects, and an Instance SAML configuration flaw that could expose internal projects or groups. GitLab also changed importer behavior after earlier importer-related problems, adding post-import mapping and user acceptance controls, and warned self-managed administrators using Direct Transfer, GitHub, Bitbucket Server, or Gitea importers to disable those features until upgraded.
Jul 24, 2026