CVE-2026-34042

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34042", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-25T15:29:04.745Z", "datePublished": "2026-03-31T01:46:15.747Z", "dateUpdated": "2026-03-31T18:53:13.564Z"}, "containers": {"cna": {"title": "act: actions/cache server allows malicious cache injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825"}, {"name": "https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7"}, {"name": "https://code.forgejo.org/forgejo/runner/issues/294", "tags": ["x_refsource_MISC"], "url": "https://code.forgejo.org/forgejo/runner/issues/294"}, {"name": "https://github.com/nektos/act/releases/tag/v0.2.86", "tags": ["x_refsource_MISC"], "url": "https://github.com/nektos/act/releases/tag/v0.2.86"}], "affected": [{"vendor": "nektos", "product": "act", "versions": [{"version": "< 0.2.86", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T01:46:15.747Z"}, "descriptions": [{"lang": "en", "value": "act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86."}], "source": {"advisory": "GHSA-x34h-54cw-9825", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T18:50:28.267177Z", "id": "CVE-2026-34042", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T18:53:13.564Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34042", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T18:50:28.267177Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T18:50:29.289Z"}}], "cna": {"title": "act: actions/cache server allows malicious cache injection", "source": {"advisory": "GHSA-x34h-54cw-9825", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nektos", "product": "act", "versions": [{"status": "affected", "version": "< 0.2.86"}]}], "references": [{"url": "https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825", "name": "https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7", "name": "https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7", "tags": ["x_refsource_MISC"]}, {"url": "https://code.forgejo.org/forgejo/runner/issues/294", "name": "https://code.forgejo.org/forgejo/runner/issues/294", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nektos/act/releases/tag/v0.2.86", "name": "https://github.com/nektos/act/releases/tag/v0.2.86", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T01:46:15.747Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34042", "state": "PUBLISHED", "dateUpdated": "2026-03-31T18:53:13.564Z", "dateReserved": "2026-03-25T15:29:04.745Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T01:46:15.747Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "act", "vendor": "nektos", "versions": [{"status": "affected", "version": "< 0.2.86"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86."}, {"lang": "es", "value": "act es un proyecto que permite la ejecuci\u00f3n local de acciones de GitHub. Antes de la versi\u00f3n 0.2.86, el servidor actions/cache integrado de act escucha las conexiones en todas las interfaces y permite que cualquiera que pueda conectarse a \u00e9l, incluyendo a alguien desde cualquier lugar de internet, cree cach\u00e9s con claves arbitrarias y recupere todos los cach\u00e9s existentes. Si pueden predecir qu\u00e9 claves de cach\u00e9 ser\u00e1n utilizadas por las acciones locales, pueden crear cach\u00e9s maliciosos que contengan los archivos que deseen, lo que muy probablemente permitir\u00eda la ejecuci\u00f3n remota de c\u00f3digo arbitrario dentro del contenedor de Docker. Este problema ha sido parcheado en la versi\u00f3n 0.2.86."}], "id": "CVE-2026-34042", "lastModified": "2026-06-17T10:38:28.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34042", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T18:50:28.267177Z", "version": "2.0.3"}}]}, "published": "2026-03-31T03:15:58.220", "references": [{"source": "security-advisories@github.com", "url": "https://code.forgejo.org/forgejo/runner/issues/294"}, {"source": "security-advisories@github.com", "url": "https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7"}, {"source": "security-advisories@github.com", "url": "https://github.com/nektos/act/releases/tag/v0.2.86"}, {"source": "security-advisories@github.com", "url": "https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.86)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "act", "source": "cna", "vendor": "nektos"}, "product": "act", "vendor": "nektos"}], "analysis": {"en": {"generated_at": "2026-03-31T05:23:23.069947+00:00", "value": {"mitigation_remediation": ["Upgrade act to version 0.2.86 or newer as the fix has been released.", "If an upgrade is not immediately feasible, restrict the cache server to localhost or block its port with firewall rules so only trusted internal processes can connect.", "Clear any existing caches that may have been populated during the vulnerable period.", "Monitor act logs for unexpected cache creation or access patterns as an additional detection measure."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the open\u2011source act tool from nektos. All releases prior to 0.2.86 are impacted; version 0.2.86 and later contain a fix that limits the cache server to specific interfaces or disables the feature by default.", "description_and_impact": "A flaw in act\u2019s built\u2011in actions/cache server allows any entity that can reach the listening port to inject arbitrary cache entries. These entries can contain malicious files that, when a local action retrieves the cache, may be executed inside its Docker container, leading to unintended code execution on the host. The weakness is a missing authorization check when creating or retrieving caches.", "risk_and_exploitability": "The CVSS score of 8.2 indicates a high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote: an adversary that can reach the cache server over the network can create or read arbitrary cache entries. Successful exploitation would allow the attacker to run arbitrary code within the containers used by local GitHub Actions workflows, potentially affecting confidentiality, integrity, and availability of the host system."}}}}, "created": "2026-03-31T19:56:26.797160+00:00", "updated": "2026-03-31T20:39:37.244773+00:00", "vendors": ["nektos", "nektos$PRODUCT$act"]}