Kaspersky GReAT conducted a large-scale security analysis of GitHub Actions pipelines across roughly 130,000 workflows in about 30,000 popular repositories. They discovered more than 250,000 potential security misconfigurations, categorized as 59.8% low risk, 39.8% medium risk, and 0.4% high risk. Eight repositories contained critical flaws that could enable supply chain compromises. Key issues include implicitly defined or overly broad access permissions, missing version pinning for dependencies, and insecure workflow-level configurations. More severe patterns such as exposure of secrets, insecure run conditions, and unsafe handling of external data were less common but present. The findings underscore the risk that misconfigured GitHub Actions pose to development environments and supply chains. Kaspersky has reported critical issues to affected maintainers and released detection rules in their Container Security product to help identify such misconfigurations.

Misconfigurations in GitHub Actions pipelines can potentially be exploited by attackers to compromise development environments or supply chains. Critical flaws found in some repositories could lead to supply chain compromise, enabling attackers to inject malicious code or steal secrets. While most issues are low or medium risk, the presence of high-risk and critical misconfigurations indicates a tangible threat to the security of CI/CD automation and associated infrastructure. This can result in unauthorized access, exposure of sensitive information, and compromise of software integrity.

No official patch or fix is applicable since these are configuration issues rather than software vulnerabilities. Kaspersky has released a set of detection rules integrated into Kaspersky Container Security to identify misconfigurations in GitHub Actions. Developers and maintainers should review their CI/CD pipeline configurations, focusing on access permissions, dependency version pinning, secret management, and handling of external data. Addressing these misconfigurations proactively will reduce the risk of supply chain compromise. The critical issues identified have been reported to the respective repository maintainers for remediation.