CVE-2026-76847

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76847", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-19T20:34:19.724Z", "datePublished": "2026-08-24T13:12:02.474Z", "dateUpdated": "2026-08-26T16:15:24.489Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-24T13:12:02.474Z"}, "datePublic": "2026-08-18T00:00:00.000Z", "title": "act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend", "descriptions": [{"lang": "en", "value": "act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "Missing Authorization", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-321", "description": "Use of Hard-coded Cryptographic Key", "type": "CWE"}]}], "affected": [{"vendor": "nektos", "product": "act", "collectionURL": "https://github.com/nektos/act", "packageName": "act", "defaultStatus": "unaffected", "versions": [{"version": "0.2.81", "lessThanOrEqual": "0.2.89", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nektos:act:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.2.81", "versionEndIncluding": "0.2.89"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://github.com/nektos/act", "tags": ["product"]}, {"url": "https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go", "tags": ["technical-description"]}, {"url": "https://github.com/nektos/act/blob/v0.2.89/cmd/root.go", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend"}], "credits": [{"lang": "en", "value": "Muhammad Sobirov", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T15:56:53.113426Z", "id": "CVE-2026-76847", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T16:15:24.489Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76847", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T15:56:53.113426Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T15:56:54.177Z"}}], "cna": {"title": "act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Sobirov"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "ADJACENT", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nektos", "product": "act", "versions": [{"status": "affected", "version": "0.2.81", "versionType": "semver", "lessThanOrEqual": "0.2.89"}], "packageName": "act", "collectionURL": "https://github.com/nektos/act", "defaultStatus": "unaffected"}], "datePublic": "2026-08-18T00:00:00.000Z", "references": [{"url": "https://github.com/nektos/act", "tags": ["product"]}, {"url": "https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go", "tags": ["technical-description"]}, {"url": "https://github.com/nektos/act/blob/v0.2.89/cmd/root.go", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend", "name": "VulnCheck Advisory: act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "Use of Hard-coded Cryptographic Key"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nektos:act:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.2.89", "versionStartIncluding": "0.2.81"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-24T13:12:02.474Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76847", "state": "PUBLISHED", "dateUpdated": "2026-08-26T16:15:24.489Z", "dateReserved": "2026-08-19T20:34:19.724Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-24T13:12:02.474Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/nektos/act", "defaultStatus": "unaffected", "packageName": "act", "product": "act", "vendor": "nektos", "versions": [{"lessThanOrEqual": "0.2.89", "status": "affected", "version": "0.2.81", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them."}, {"lang": "es", "value": "act inicia un backend HTTP Artifacts V4 siempre que un flujo de trabajo utiliza actions/upload-artifact@v4 o actions/download-artifact@v4. Los RPCs del plano de control de ese backend, incluyendo CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact y DeleteArtifact, aceptan un workflow_run_backend_id proporcionado por el llamador y nunca verifican que pertenezca al solicitante: validateRunIDV4 en pkg/artifacts/artifacts_v4.go analiza el valor y lo devuelve con la comparaci\u00f3n contra el ID de ejecuci\u00f3n de la tarea solicitante dejada comentada. Las URLs firmadas que emite el backend son autenticadas por un HMAC cuya clave est\u00e1 codificada a los cuatro bytes 0xba 0xdb 0xee 0xf0, id\u00e9ntica en cada compilaci\u00f3n, calculada sobre una concatenaci\u00f3n de endpoint, caducidad, nombre de artefacto e ID de tarea sin prefijo de longitud ni delimitador, por lo que las firmas son tanto falsificables como ambiguas entre pares diferentes de nombre de artefacto e ID de tarea. El flag --artifact-server-addr por defecto es la direcci\u00f3n de salida del host en lugar de loopback, dejando el backend accesible desde la red circundante. Cualquier cliente que pueda alcanzarlo puede leer, sobrescribir o eliminar los artefactos de un trabajo que se ejecuta concurrentemente sin credenciales, exponiendo salidas de compilaci\u00f3n como secretos y credenciales de despliegue y permitiendo su reemplazo antes de que el trabajo propietario los consuma."}], "id": "CVE-2026-76847", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76847", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T15:56:53.113426Z", "version": "2.0.3"}}]}, "published": "2026-08-24T14:17:02.857", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/nektos/act"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/nektos/act/blob/v0.2.89/cmd/root.go"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}, {"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.2.81,0.2.89]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "act", "source": "cna", "vendor": "nektos"}, "product": "act", "vendor": "nektos"}], "created": "2026-08-24T16:45:06.189212+00:00", "updated": "2026-08-24T18:00:04.956623+00:00", "vendors": ["nektos", "nektos$PRODUCT$act"]}