Owasp Cicd

title: 'CICD-SEC-1: Insufficient Flow Control Mechanisms' description: OWASP CI/CD Top 10 reference for insufficient flow control vulnerabilities including unauthorized code changes and deployment bypass

01 Insufficient Flow Control Mechanisms

Identifier: CICD-SEC-1:2025 Category: Flow Control

Description

Insufficient flow control mechanisms refer to the ability of an attacker that has obtained permissions to a system within the CI/CD process (SCM, CI, artifact repository) to single-handedly push malicious code or artifacts down the pipeline, due to a lack of mechanisms that enforce additional approval or review.

CI/CD flows are designed for speed. New code can be created on a developer's machine and reach production within minutes, often with full reliance on automation and minimal human involvement. Since CI/CD processes are the highway to highly gated and secured production environments, organizations must introduce measures and controls to ensure that no single entity (human or application) can push code or artifacts through the pipeline without undergoing a strict set of reviews and approvals.

Risk

• An attacker with access to the SCM, CI, or downstream systems can deploy malicious artifacts potentially all the way to production without any approval or review.

• Pushing code to a repository branch that is automatically deployed through the pipeline to production.

• Abusing auto-merge rules that automatically merge pull requests meeting a predefined set of requirements, pushing malicious unreviewed code.

• Abusing insufficient branch protection rules, such as excluding specific users or branches, to bypass protections and push malicious unreviewed code.

• Uploading artifacts to a repository in the guise of a legitimate artifact created by the build environment, which may be picked up by a deploy pipeline and deployed to production.

• Directly changing application code or infrastructure in production without additional verification.

Vulnerability checklist

• Repository branches hosting production code lack branch protection rules.

• Users or branches are excluded from branch protection rules.

• Auto-merge rules exist that can be bypassed or manipulated.

• Pipeline triggers do not require additional approval for production deployments.

• Artifacts uploaded by non-CI service accounts are not blocked or reviewed before flowing through the pipeline.

• No drift detection exists between code running in production and its CI/CD origin.

• Single accounts have both push-to-repository and trigger-deployment permissions.

Prevention controls

1. Configure branch protection rules on branches hosting code used in production and other sensitive systems.

2. Avoid excluding user accounts or branches from branch protection rules.

3. Ensure accounts with permission to push unreviewed code do not also have permission to trigger deployment pipelines connected to the repository.

4. Limit auto-merge rule usage and ensure they apply to the minimal number of contexts.

5. Review auto-merge rule code thoroughly to prevent bypass and avoid importing third-party code in the auto-merge process.

6. Prevent accounts from triggering production build and deployment pipelines without additional approval or review.

7. Allow artifacts to flow through the pipeline only when created by a pre-approved CI service account.

8. Detect and prevent drifts between code running in production and its CI/CD origin, and modify any resource that contains a drift.

Example attack scenarios

Scenario A — Unprotected branch deployment

An attacker gains access to a developer account on the SCM. The main branch lacks branch protection rules. The attacker pushes malicious code directly to the main branch, triggering an automated pipeline that deploys the code to production without any review or approval gate.

Scenario B — Auto-merge rule bypass

An organization uses auto-merge rules to merge pull requests that pass automated checks. An attacker crafts a pull request that satisfies the auto-merge criteria while containing a malicious payload hidden in an overlooked file type. The PR is automatically merged and deployed to production without human review.

Detection guidance

• Audit branch protection rule configurations across all repositories hosting production code.

• Review auto-merge rule logic and history of auto-merged pull requests for anomalies.

• Monitor pipeline triggers and correlate them with code review and approval records.

• Detect configuration drifts between deployed resources and their CI/CD source definitions.

• Alert on artifacts flowing through deployment pipelines that were not produced by approved CI service accounts.

Remediation

• Enable and enforce branch protection rules on all branches linked to production deployments.

• Remove all user and branch exclusions from branch protection rules.

• Separate push-to-repository and trigger-deployment permissions across distinct accounts.

• Audit and harden all auto-merge rules, removing those that are overly permissive.

• Implement artifact provenance validation to ensure only CI-produced artifacts enter deploy pipelines.

• Deploy drift detection tooling to identify and alert on unauthorized production changes.