← Sunday, September 27, 2026SecurityDeep dive

CI/CD attacks exploit cache poisoning, OIDC tokens, and mutable action tags

cloud.google.com by Mandiant 15 min read Editor score 7/10

The guidance describes attacks on developer tools and build pipelines, including GitHub Actions cache poisoning, OIDC token extraction, and changing action tags to publish compromised packages. These tactics expose risks in trusted automation with elevated privileges.

What

CI/CD supply-chain campaigns compromise trusted security scanners, utility libraries, and AI developer tools to exploit build-pipeline privileges.

How

Attacks also target workstations and IDEs, and manipulate pipelines through cache poisoning, OIDC token extraction, and mutable action tags.

Why it matters

Defending the software supply chain requires safeguards across developer environments and the full software development lifecycle.

Read on cloud.google.com →

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.