CNCF Project Antrea Compromised in Daring GitHub Attack

On May 2, 2026 an unknown actor (GitHub account 0xedgerunner) launched a malicious pull-request campaign against the CNCF Antrea project that used forked-PR triggered Jenkins jobs to execute payloads (Python deserialization and shell scripts) which probed the Jenkins controller, attempted to harvest IMDSv2 AWS credentials and local secrets, and exfiltrated data via paste.rs and webhook.site; the PR was closed after maintainers detected the activity, the report documents IOCs and recommends SHA-pinning actions and requiring maintainer approval for slash-command CI triggers.