---
title: OWASP CI/CD Top 10 Vulnerability Index
description: Index of OWASP Top 10 CI/CD Security Risks (2025) vulnerability identifiers, categories, and cross-references
---

# 00 Vulnerability Index

This document provides the index for the OWASP CI/CD Security Top 10 vulnerabilities.
Each entry includes its identifier, title, and primary category.

## Vulnerability catalog

| ID               | Title                                     | Category                 |
|------------------|-------------------------------------------|--------------------------|
| CICD-SEC-1:2025  | Insufficient Flow Control Mechanisms      | Flow Control             |
| CICD-SEC-2:2025  | Inadequate Identity and Access Management | Identity Management      |
| CICD-SEC-3:2025  | Dependency Chain Abuse                    | Supply Chain             |
| CICD-SEC-4:2025  | Poisoned Pipeline Execution               | Pipeline Security        |
| CICD-SEC-5:2025  | Insufficient PBAC                         | Access Controls          |
| CICD-SEC-6:2025  | Insufficient Credential Hygiene           | Credential Management    |
| CICD-SEC-7:2025  | Insecure System Configuration             | Configuration Management |
| CICD-SEC-8:2025  | Ungoverned Usage of 3rd Party Services    | Third-Party Governance   |
| CICD-SEC-9:2025  | Improper Artifact Integrity Validation    | Artifact Integrity       |
| CICD-SEC-10:2025 | Insufficient Logging and Visibility       | Logging and Visibility   |

## Cross-reference matrix

Each vulnerability document follows a consistent structure:

1. Description — what the vulnerability is and how it manifests in CI/CD environments.
2. Risk — concrete consequences of exploitation and business impact.
3. Vulnerability checklist — indicators that the environment is exposed.
4. Prevention controls — defensive measures and rectification steps.
5. Example attack scenarios — realistic exploitation narratives.
6. Detection guidance — signals and methods to identify exposure.
7. Remediation — immediate and long-term actions to contain and resolve.

## Category groupings

### Flow Control

* CICD-SEC-1:2025 Insufficient Flow Control Mechanisms

### Identity Management

* CICD-SEC-2:2025 Inadequate Identity and Access Management

### Supply Chain

* CICD-SEC-3:2025 Dependency Chain Abuse

### Pipeline Security

* CICD-SEC-4:2025 Poisoned Pipeline Execution

### Access Controls

* CICD-SEC-5:2025 Insufficient PBAC

### Credential Management

* CICD-SEC-6:2025 Insufficient Credential Hygiene

### Configuration Management

* CICD-SEC-7:2025 Insecure System Configuration

### Third-Party Governance

* CICD-SEC-8:2025 Ungoverned Usage of 3rd Party Services

### Artifact Integrity

* CICD-SEC-9:2025 Improper Artifact Integrity Validation

### Logging and Visibility

* CICD-SEC-10:2025 Insufficient Logging and Visibility
