CircleCI access control & privilege security checks
Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.
On CircleCI, Black Cat runs 7 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the CircleCI connector needs.
Checks (7)
severity: medium No Groups Defined fix difficulty: medium #
Create organization groups in CircleCI to scope context access to specific teams
- Sign in to CircleCI and navigate to Organization Settings
- Select "Groups" from the left-hand navigation
- Click "Create Group" and provide a descriptive name for each team or role
- Add relevant organization members to each group
- Navigate to "Contexts" and apply group-based restrictions to sensitive contexts
- Verify that only members of the assigned group can trigger jobs using each restricted context
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Unrestricted Context fix difficulty: easy #
Add project or group restrictions to CircleCI contexts to limit which pipelines can access secrets
- Sign in to CircleCI and navigate to Organization Settings
- Select "Contexts" from the left-hand navigation
- Click the name of the unrestricted context to open its detail page
- Click "Add Restriction" and select either a project or a group
- Choose the specific projects or groups that legitimately need this context
- Save the restrictions and verify that other pipelines no longer have access
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high User Checkout Key fix difficulty: medium #
Replace user checkout keys with project deploy keys to limit VCS repository access
- Sign in to CircleCI and navigate to the affected project's settings
- Select "SSH Keys" from the left-hand navigation
- Under "Checkout SSH Keys", identify any "User Key" entries
- Click "Add Deploy Key" to generate a new read-only deploy key scoped to this repository
- Update your VCS (GitHub/GitLab/Bitbucket) to trust the new deploy key
- Delete the existing user checkout key and confirm pipelines check out code successfully
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium OIDC Not Configured fix difficulty: hard #
Configure OIDC token claims in CircleCI to enable keyless cloud authentication without stored credentials
- Sign in to CircleCI and navigate to Organization Settings
- Select "Security" from the left-hand navigation and review the OIDC token settings
- In your cloud provider (AWS, GCP, or Azure), create a new OIDC identity provider pointing to CircleCI's OIDC URL
- Define an IAM role or service account with a trust policy that validates CircleCI's OIDC token claims
- Update your pipeline config to use the OIDC token environment variable instead of stored access keys
- Remove any long-lived cloud credentials previously stored as environment variables or context secrets
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: low Empty Group fix difficulty: easy #
Remove empty groups or add members to maintain accurate access control
- Sign in to CircleCI and navigate to Organization Settings
- Select "Groups" from the left-hand navigation
- Identify the flagged group with zero members
- If the group is no longer needed, delete it to reduce configuration clutter
- If the group is still needed, add the appropriate organization members
- Review any context restrictions that reference this group to ensure they are still valid
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Large Group fix difficulty: medium #
Review large groups and split them into smaller, role-based groups for tighter access control
- Sign in to CircleCI and navigate to Organization Settings
- Select "Groups" from the left-hand navigation
- Open the flagged group and review the full member list
- Identify members who do not need access to all contexts restricted to this group
- Create smaller groups based on team or role boundaries
- Update context restrictions to use the smaller groups and remove excess members from the original group
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium OIDC Default Audience fix difficulty: medium #
Set a specific OIDC audience to restrict where CircleCI tokens are accepted
- Sign in to CircleCI and navigate to Organization Settings
- Select "Security" from the left-hand navigation
- Locate the OIDC configuration and find the audience field
- Set the audience to your organization's specific identifier or cloud provider audience URL
- Update your cloud provider's OIDC identity provider configuration to validate the new audience
- Test a pipeline that uses OIDC authentication to confirm tokens are accepted with the new audience
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2