Abusing CI/CD Pipelines and OIDC Federation

CI/CD pipelines are high-privilege execution environments, often with direct cloud IAM access, deploy credentials, and signing keys. OIDC federation turns a repository write into cloud credential issuance when the trust policy is too broad. A single misconfigured workflow or a wildcard subject claim can bridge the gap from "can open a pull request" to "has production cloud access."

When to Use

• Assessing GitHub Actions, GitLab CI, or Jenkins for exploitable misconfigurations
• Testing OIDC federation trust policies between CI providers and cloud platforms
• Extracting secrets, tokens, or credentials from pipeline execution environments
• Evaluating self-hosted runner isolation and shared runner risk
• Attempting lateral movement from CI/CD into cloud accounts via OIDC
• Reviewing build artifact integrity and cache poisoning attack surface

When NOT to Use