Preliminary research
Deployment Poisoning: A(nother) Novel Attack Vector for GitHub Actions
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
A workflow in a fork pull request can name an environment that does not exist; GitHub creates it and emits a deployment_status event that runs the default branch's workflow with secrets. The environment name is attacker-chosen, so a ${{ }} expression in a run step executes it, and even after that is fixed the environment_url is attacker-set, sending API keys to their server. 38 public apps produce deployments; Argos CI and Checkly shipped vulnerable example workflows.
Record
- Researcher
- Boost Security Labs
- Published by
- Boost Security Labs
- Topic
- Supply
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Boost Security Labs, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .