---
title: OWASP CI/CD Top 10 Vulnerability Index
description: Index of OWASP Top 10 CI/CD Security Risks (2025) vulnerability identifiers, categories, and cross-references
---

# 00 Vulnerability Index

This document provides the index for the OWASP CI/CD Security Top 10 vulnerabilities.
Each entry includes its identifier, title, and primary category.

## Vulnerability catalog

| ID | Title | Category |
|---|---|---|
| CICD-SEC-1:2025 | Insufficient Flow Control Mechanisms | Flow Control |
| CICD-SEC-2:2025 | Inadequate Identity and Access Management | Identity Management |
| CICD-SEC-3:2025 | Dependency Chain Abuse | Supply Chain |
| CICD-SEC-4:2025 | Poisoned Pipeline Execution | Pipeline Security |
| CICD-SEC-5:2025 | Insufficient PBAC | Access Controls |
| CICD-SEC-6:2025 | Insufficient Credential Hygiene | Credential Management |
| CICD-SEC-7:2025 | Insecure System Configuration | Configuration Management |
| CICD-SEC-8:2025 | Ungoverned Usage of 3rd Party Services | Third-Party Governance |
| CICD-SEC-9:2025 | Improper Artifact Integrity Validation | Artifact Integrity |
| CICD-SEC-10:2025 | Insufficient Logging and Visibility | Logging and Visibility |

## Cross-reference matrix

Each vulnerability document follows a consistent structure:

1. Description — what the vulnerability is and how it manifests in CI/CD environments.
2. Risk — concrete consequences of exploitation and business impact.
3. Vulnerability checklist — indicators that the environment is exposed.
4. Prevention controls — defensive measures and rectification steps.
5. Example attack scenarios — realistic exploitation narratives.
6. Detection guidance — signals and methods to identify exposure.
7. Remediation — immediate and long-term actions to contain and resolve.

## Category groupings

### Flow Control

* CICD-SEC-1:2025 Insufficient Flow Control Mechanisms

### Identity Management

* CICD-SEC-2:2025 Inadequate Identity and Access Management

### Supply Chain

* CICD-SEC-3:2025 Dependency Chain Abuse

### Pipeline Security

* CICD-SEC-4:2025 Poisoned Pipeline Execution

### Access Controls

* CICD-SEC-5:2025 Insufficient PBAC

### Credential Management

* CICD-SEC-6:2025 Insufficient Credential Hygiene

### Configuration Management

* CICD-SEC-7:2025 Insecure System Configuration

### Third-Party Governance

* CICD-SEC-8:2025 Ungoverned Usage of 3rd Party Services

### Artifact Integrity

* CICD-SEC-9:2025 Improper Artifact Integrity Validation

### Logging and Visibility

* CICD-SEC-10:2025 Insufficient Logging and Visibility

---

*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*
