Forking Around and Finding Out : How a PR dismantles a cloud

As organizations shift toward cloud-native architectures, the security perimeter has transitioned from traditional network boundaries to Identity and Access Management (IAM) and automation platforms. Continuous Integration and Continuous Deployment (CI/CD) pipelines now serve as the primary gateway to cloud infrastructure. This presentation examines the critical vulnerability of Poisoned Pipeline Execution (PPE)-specifically focusing on the misuse of the pull_request_target trigger in GitHub Actions.

​

We analyze how attackers can exploit implicit trust models in open-source collaboration to escalate privileges from an unprivileged fork repository to administrative control within a federated cloud environment (e.g., AWS, GCP). Finally, we propose a robust, zero-trust architectural framework to mitigate these risks using the Two-Workflow pattern and strict OIDC conditional claims.