← OWASP Top 10 CI/CD Security Risks
CICD-SEC-7
Insecure System Configuration
The CI/CD systems themselves are left unpatched or loosely configured, from self-hosted runners to the source control server. A flaw in the platform bypasses every control built on top of it.
Summary in ghtier's words. Read OWASP CI/CD's own text
Incidents (7)
Last 12 months (1): CVE-2026-3854: push-option metadata RCE
2026
- CVE-2026-3854: push-option metadata RCEEnterprise March 2026
2025
- CVE-2025-11578: pre-receive hook symlink escapeEnterprise October 2025
- CVE-2025-3509: pre-receive hook RCE via port reuseEnterprise April 2025
2024
- CVE-2024-4985: SAML auth bypassEnterprise May 2024
- CVE-2024-1374: Management Console template injectionEnterprise February 2024
2023
- Self-hosted runner takeovers (PyTorch and others)Organization January 2023
2022
- CVE-2022-23732: Management Console path traversal / CSRF bypassEnterprise January 2022
Attack path techniques used
- Read secrets from the runner (Steal CI secrets and tokens)
- Backdoor a persistent self-hosted runner (Poison the build or published package)
- Forge a login (Take over the GHES appliance)
- Escalate from a GHES role to root (Take over the GHES appliance)
Checklist items
The fixes for those techniques, plus the items ghtier tags with this risk.
- Third-party Actions pinned to a full commit SHA instead of a mutable tag or branch
- Restrict which Actions can run to GitHub-verified creators or an internal allow-list
- Set the default GITHUB_TOKEN permission to read-only at the org level
- Disallow self-hosted runners on public repositories
- Require approval for first-time/external contributor workflow runs on forks
- Limit the number of organization owners to the minimum needed
- Disable password-based Git authentication (Enterprise Server only)
- Restrict public repo creation, visibility changes, repo deletion, private forks and outside collaborator invites to owners
- Classify repos with custom properties (data classification, criticality, compliance scope)
- Enforce an IP allow list for Git and web UI access from trusted ranges
- Back up repositories and metadata outside GitHub, and rehearse a restore
Permissions involved
The GitHub permissions those incidents abused.