CI/CD credential hygiene failures

Secrets exposed in logs, environments or artifacts

categoryCloud, container and supply chain attacksseverityHighdetectabilityHighlabnot yet measured

Classification

38 values: 22 imported, 4 derived, 12 machine-classified. What do these mean?

Exploitability

Attack vector	Credential attacksMisconfigurationSoftware vulnerabilitiesSupply chain
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Established

Impact & scope

Severity	High
Impact	Confidentiality
Platform	ContainersIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
Environment	Cloud
Target asset class	IdentitySupply chain
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentCloud Service MetadataCommand ExecutionFile AccessFile CreationNetwork Traffic ContentProcess CreationUser Account AuthenticationWindows Registry Key Modification

Detection & response

Mitigated by 38

M1015 attack-mitigation
M1017 attack-mitigation
M1022 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1028 attack-mitigation
M1035 attack-mitigation
M1037 attack-mitigation
M1041 attack-mitigation
M1047 attack-mitigation
M1051 attack-mitigation
D3-AM d3fend
D3-ANCI d3fend
D3-CCSA d3fend
D3-CF d3fend
D3-CH d3fend
D3-CI d3fend
D3-CM d3fend
D3-CQ d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CTS d3fend
D3-DF d3fend
D3-DI d3fend
D3-DUC d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-MFA d3fend
D3-NTPM d3fend
D3-RC d3fend
D3-RD d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-RIC d3fend
D3-SCP d3fend

Detected by 57

DET0412 attack-detection-strategy
04936b66-3915-43ad-a8e5-809eadfd1141 sigma
05f3c945-dcc8-4393-9f3d-af65077a8f86 sigma
0aba5685-6db6-486f-88ef-29a99c545cfd sigma
0cf7a157-8879-41a2-8f55-388dd23746b7 sigma
0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6 sigma
1a0f6f16-2099-4753-9a02-43b6ac7a1fa5 sigma
1b45b0d1-773f-4f23-aedc-814b759563b1 sigma
1f978c6a-4415-47fb-aca5-736a44d7ca3d sigma
213d6a77-3d55-4ce8-ba74-fcfef741974e sigma
3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe sigma
44030449-b0df-4c94-aae1-502359ab28ee sigma
459a2970-bb84-4e6a-a32e-ff0fbd99448d sigma
47e4bab7-c626-47dc-967b-255608c9a920 sigma
508a9374-ad52-4789-b568-fc358def2c65 sigma
53b1b378-9b06-4992-b972-dde6e423d2b4 sigma
587254ee-a24b-4335-b3cd-065c0f1f4baa sigma
68fcba0d-73a5-475e-a915-e8b4c576827e sigma
6ad91e31-53df-4826-bd27-0166171c8040 sigma
6d3a3952-6530-44a3-8554-cf17c116c615 sigma
6ea858a8-ba71-4a12-b2cc-5d83312404c7 sigma
74298991-9fc4-460e-a92e-511aa60baec1 sigma
76a26006-0942-430b-8249-bd51d448f8e5 sigma
7892ec59-c5bb-496d-8968-e5d210ca3ac4 sigma
80eeab92-0979-4152-942d-96749e11df40 sigma
8344c19f-a023-45ff-ad63-a01c5396aea0 sigma
851fd622-b675-4d26-b803-14bc7baa517a sigma
87a476dc-0079-4583-a985-dee7a20a03de sigma
91a2c315-9ee6-4052-a853-6f6a8238f90d sigma
91b76b84-8589-47aa-9605-c837583b82a9 sigma
9cd55b6c-430a-4fa9-96f4-7cadf5229e9f sigma
9e716b33-63b2-46da-86a4-bd3c3b9b5dfb sigma
a61a3c56-4ce2-4351-a079-88ae4cbd2b58 sigma
aa7a3fce-bef5-4311-9cc1-5f04bb8c308c sigma
b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b sigma
b2815d0d-7481-4bf0-9b6c-a4c48a94b349 sigma
b831353c-1971-477b-abb6-2828edc3bca1 sigma
b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee sigma
bd5971a7-626d-46ab-8176-ed643f694f68 sigma
beaa66d6-aa1b-4e3c-80f5-e0145369bfaf sigma
… and 17 more in the database

Tested by 65

00e3e3c7-6c3c-455e-bd4b-461c7f0e7797 atomic
0d4f2281-f720-4572-adc8-d5bb1618affe atomic
0e56bf29-ff49-4ea5-9af4-3b81283fd513 atomic
114dd4e3-8d1c-4ea7-bb8d-8d8f6aca21f0 atomic
12e4a260-a7fd-4ed8-bf18-1a28c1395775 atomic
14575d1f-16b3-4a0b-8986-540e42e6a6cc atomic
18318786-e0c0-4bdf-979f-f022e6f5f2ef atomic
290df60e-4b5d-4a5e-b0c7-dc5348ea0c86 atomic
2951c09f-b4f9-4248-ba75-6373709ebd55 atomic
2a24627b-061b-43e6-bece-a5b0638841dd atomic
2a5a0601-f5fb-4e2e-aa09-73282ae6afca atomic
31e794c4-48fd-4a76-aca4-6587c155bc11 atomic
336b25bf-4514-4684-8924-474974f28137 atomic
367d4004-5fc0-446d-823f-960c74ae52c3 atomic
37807632-d3da-442e-8c2e-00f44928ff8f atomic
3cfde62b-7c33-4b26-a61e-755d6131c8ce atomic
42c55554-3dcb-4df6-8fbb-c8ccacc478d4 atomic
43c3a49d-d15c-45e6-b303-f6e177e44a9a atomic
46959285-906d-40fa-9437-5a439accd878 atomic
51cde30c-0311-449a-8e15-542b59f95939 atomic
520ce462-7ca7-441e-b5a5-f8347f632696 atomic
5312c7c3-775b-4437-a8b0-914b30cfebd4 atomic
5a668739-3a2f-4265-895f-c0e1e0b09eaa atomic
5e417277-0ae7-4ad5-a3e8-0fa27c122b29 atomic
75f66e03-37d3-4704-9520-3210efbe33ce atomic
7617f689-bbd8-44bc-adcd-6f8968897848 atomic
788e0019-a483-45da-bcfe-96353d46820f atomic
78b274f8-acb0-428b-b1f7-7b0d0e73330a atomic
78e95057-d429-4e66-8f82-0f060c1ac96f atomic
7c247dc7-5128-4643-907b-73a76d9135c3 atomic
864bb0b2-6bb5-489a-b43b-a77b3a16d68a atomic
870fe8fb-5e23-4f5f-b89d-dd7fe26f3b5f atomic
8f2765a8-e795-438b-a102-5e25a7adcce1 atomic
922b1080-0b95-42b0-9585-b9a5ea0af044 atomic
98618067-a2c7-4d4b-9c89-403a90f43656 atomic
9d9c22c9-fa97-4008-a204-478cf68c40af atomic
9e507bb8-1d30-4e3b-a49b-cb5727d7ea79 atomic
a11f22fb-a037-4cc2-bcfc-a133b287aa1b atomic
a21118de-b11e-4ebd-b655-42f11142df0c atomic
a8f6148d-478a-4f43-bc62-5efee9f931a4 atomic
… and 25 more in the database

Attack relationships

Child: AI coding-assistant config / key theft
Child: CA key theft / forged certs
Child: Cluster-to-cloud lateral movement
Child: Crypto private key theft
Child: Kubernetes API server abuse
Child: Metadata credential theft
Child: Secrets in ConfigMaps / env vars
Child: SSH key / private key theft
Child: SSRF to instance metadata
Child: Unsecured credentials

Framework references

Primary source: https://owasp.org/www-project-top-10-ci-cd-security-risks/
owasp-cicd: CICD-SEC-6 (primary)
attack: T1552
cwe: CWE-532

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Cloud, container and supply chain attacks' table, line 426 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1552, cwe:CWE-532 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Common Weakness Enumeration (CWE) 4.20) — Linked to CWE-532 'Insertion of Sensitive Information into Log File', a CWE Base-level weakness (CWE 4.20).
Insertion of Sensitive Information into Log File
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 6 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)