A recent investigation has uncovered critical security vulnerabilities in GitHub Actions workflows used by several major open source projects, including those maintained by MITRE and Splunk.
Researchers highlighted that poor security practices around continuous integration and continuous delivery (CI/CD) pipelines have left these repositories open to exploitation, potentially allowing attackers to gain high-level access and exfiltrate sensitive repository secrets.
Widespread Security Flaws Expose Repositories
GitHub Actions has rapidly become the industry standard for automating build, testing, and deployment workflows in open source development. Its convenience and integration power, however, come with a growing set of security risks.
Researchers from Sysdig Threat Research Team (TRT), in collaboration with MITRE and Splunk security analysts, disclosed that many widely-used repositories were susceptible to known attack vectors, some of which have been documented for years but remain unaddressed.
A primary culprit is the misuse of the pull_request_target trigger in GitHub Actions, a workflow event designed to process pull requests.
While powerful, this event executes in the context of the repository’s default branch and, crucially, inherits sensitive secrets and a high-privilege GITHUB_TOKEN environment variable.
If improperly configured, workflows leveraging pull_request_target can inadvertently run untrusted code contributed by external collaborators, giving attackers a vector to execute arbitrary code or steal sensitive information.
MITRE and Splunk Affected by CI/CD Workflow Gaps
Case studies in the report demonstrate the severity and breadth of the issue. The popular Python library repository, Spotipy, was identified as critically vulnerable (CVE-2025-47928) due to a workflow that installed untrusted Python packages via pip from forked pull requests.
Malicious actors could modify setup files to execute scripts that extract secrets and tokens, enabling full repository takeover.
MITRE’s Cyber Analytics Repository (CAR) and Splunk’s Security Content repository were found to suffer from similar workflow misconfigurations, allowing attackers to install malicious dependencies or exfiltrate credentials.
While MITRE promptly addressed the vulnerability upon disclosure, Splunk’s response was less forthcoming, though the workflow has since been patched.
The implications extend far beyond these high-profile cases. The investigators found dozens of additional repositories, many with thousands of stars and active user bases, that failed to adopt essential CI/CD security best practices.
These include restricting the permissions of the GITHUB_TOKEN, splitting workflows to isolate privileged operations, and avoiding the execution of untrusted code with access to repository secrets.
The report recommends several mitigation strategies. Project maintainers should avoid using pull_request_target unless absolutely necessary and, if used, must ensure workflows do not directly execute code from external contributors.
According to the Report, Workflow permissions should be minimized, for instance by explicitly setting the GITHUB_TOKEN to read-only unless writes are required.
Additionally, using label-based gating or requiring manual review before privileged workflows execute can provide a layer of protection, but these approaches are not foolproof due to potential race conditions.
For proactive threat detection, the researchers advocate integrating open-source tools such as Falco Actions into CI/CD pipelines.
These solutions can monitor for anomalous activity in real time, alerting maintainers to suspicious network connections, memory scans, or attempts at credential exfiltration during workflow execution.
The disclosure highlights an urgent need to elevate the maturity of security practices surrounding open source automation pipelines.
As attackers increasingly target the software supply chain, the community must prioritize robust security configurations for CI/CD automation to safeguard the integrity of critical open source projects.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
