CVE-2026-76847
act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend
Description
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them.
INFO
Published Date :
Aug. 24, 2026, 2:17 p.m.
Last Modified :
Oct. 12, 2026, 3:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Uncomment the run ID comparison in validateRunIDV4.
- Use a unique, strong HMAC key.
- Validate artifact names and task IDs.
- Bind the backend to loopback address.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-76847.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-76847 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-76847
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-76847 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-76847 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: act de nektos, Description: act inicia un backend HTTP Artifacts V4 siempre que un flujo de trabajo utiliza actions/upload-artifact@v4 o actions/download-artifact@v4. Los RPCs del plano de control de ese backend, incluyendo CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact y DeleteArtifact, aceptan un workflow_run_backend_id proporcionado por el llamador y nunca verifican que pertenezca al solicitante: validateRunIDV4 en pkg/artifacts/artifacts_v4.go analiza el valor y lo devuelve con la comparación contra el ID de ejecución de la tarea solicitante dejada comentada. Las URLs firmadas que emite el backend son autenticadas por un HMAC cuya clave está codificada a los cuatro bytes 0xba 0xdb 0xee 0xf0, idéntica en cada compilación, calculada sobre una concatenación de endpoint, caducidad, nombre de artefacto e ID de tarea sin prefijo de longitud ni delimitador, por lo que las firmas son tanto falsificables como ambiguas entre pares diferentes de nombre de artefacto e ID de tarea. El flag --artifact-server-addr por defecto es la dirección de salida del host en lugar de loopback, dejando el backend accesible desde la red circundante. Cualquier cliente que pueda alcanzarlo puede leer, sobrescribir o eliminar los artefactos de un trabajo que se ejecuta concurrentemente sin credenciales, exponiendo salidas de compilación como secretos y credenciales de despliegue y permitiendo su reemplazo antes de que el trabajo propietario los consuma. -
CVE Modified by [email protected]
Aug. 26, 2026
Action Type Old Value New Value Added Reference https://github.com/nektos/act Added Reference https://github.com/nektos/act/blob/v0.2.89/cmd/root.go Added Reference https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go Added Reference https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend Removed Reference https://github.com/nektos/act Removed Reference https://github.com/nektos/act/blob/v0.2.89/cmd/root.go Removed Reference https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go Removed Reference https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 26, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-76847', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-26T15:56:53.113426Z'} -
New CVE Received by [email protected]
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'nektos', 'product': 'act', 'versions': [{'status': 'affected', 'version': '0.2.81', 'versionType': 'semver', 'lessThanOrEqual': '0.2.89'}], 'packageName': 'act', 'collectionURL': 'https://github.com/nektos/act', 'defaultStatus': 'unaffected'}] Added Description act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them. Added CVSS V4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-321 Added CWE CWE-862 Added Reference https://github.com/nektos/act Added Reference https://github.com/nektos/act/blob/v0.2.89/cmd/root.go Added Reference https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go Added Reference https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend