CVE-2026-76847
Received Received - Intake

Artifact Server V4 Backend Unauthenticated Access and Signature Forgery

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76847
EUVD
EUVD-2026-64852

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nektos act From 0.2.81 (inc) to 0.2.89 (inc)
nektos act 0.2.89

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in act's Artifacts V4 backend allows unauthenticated users to access, modify, or delete artifacts from other workflow runs due to missing authorization checks and a hardcoded HMAC key. The backend exposes control-plane RPCs like artifact upload/download without validating ownership, enabling attackers to forge signatures and manipulate artifacts.

Detection Guidance

Check if act is running with the Artifacts V4 backend by inspecting network connections to the artifact server address. Use commands like 'netstat -tulnp | grep act' or 'ss -tulnp | grep act' to see if the backend is listening on an outbound address. Verify if the artifact server is exposed by checking act logs for '--artifact-server-addr' usage.

Impact Analysis

Attackers could steal sensitive build outputs like secrets or deployment credentials, replace legitimate artifacts with malicious ones, or delete critical artifacts. This affects CI/CD pipelines using act versions 0.2.81-0.2.89, especially if the backend is exposed on a network interface.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive build outputs such as secrets and deployment credentials. For GDPR, this may result in unauthorized data exposure or processing of personal data without consent. For HIPAA, it could allow unauthorized access to protected health information during CI/CD workflows.

Mitigation Strategies

Upgrade act to a version beyond 0.2.89 where the vulnerability is fixed. Disable the Artifacts V4 backend if not needed by avoiding actions/upload-artifact@v4 and actions/download-artifact@v4. Restrict network access to the artifact server by binding it to 127.0.0.1 using the '--artifact-server-addr' flag.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart