CVE-2026-92717 Authentication Bypass in Covenant

Covenant versions 0.6 and earlier suffer from a critical authentication bypass vulnerability (CVE-2026-92717) due to a missing 'Authorize' attribute on the 'CovenantHub' SignalR hub. This oversight permits unauthenticated network callers to invoke the 'CreateHttpListener' method, which returns a valid signed JWT token. An attacker who successfully calls this method can use the returned token to authenticate against the Covenant operator API. This grants the attacker full control over the C2 infrastructure, including the ability to manage grunts, access stored credentials, modify binaries, and exfiltrate sensitive operational data and event logs. Because the vulnerability involves a core architectural flaw in the SignalR hub configuration, it significantly lowers the barrier for unauthorized parties to hijack a Covenant deployment. Defenders should prioritize patching or restricting access to the Covenant management interface.

Impact

Successful exploitation allows full administrative control over the Covenant C2 framework. An attacker can access all grunts, exfiltrate credentials gathered from target environments, modify or deploy malicious binaries, and retrieve operator roster and event history. This provides an attacker with the ability to maintain persistence, escalate privileges, and steal data harvested by the C2 platform.

Recommendation

• Restrict network access to the Covenant management interface using network firewalls or VPNs until the software is updated.
• Patch Covenant instances to a version addressing CVE-2026-92717 immediately.
• Monitor SignalR traffic to the Covenant hub for unauthenticated calls to the 'CreateHttpListener' method.