Cve-2026-92717 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-92717/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 19:51:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-92717 Authentication Bypass in Covenanthttps://feed.craftedsignal.io/briefs/2026-09-covenant-auth-bypass/Wed, 16 Sep 2026 19:51:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-covenant-auth-bypass/Covenant versions 0.6 and earlier contain an authentication bypass vulnerability allowing unauthenticated remote actors to gain full operator API access via the CovenantHub SignalR hub.Covenant versions 0.6 and earlier suffer from a critical authentication bypass vulnerability (CVE-2026-92717) due to a missing 'Authorize' attribute on the 'CovenantHub' SignalR hub. This oversight permits unauthenticated network callers to invoke the 'CreateHttpListener' method, which returns a valid signed JWT token. An attacker who successfully calls this method can use the returned token to authenticate against the Covenant operator API. This grants the attacker full control over the C2 infrastructure, including the ability to manage grunts, access stored credentials, modify binaries, and exfiltrate sensitive operational data and event logs. Because the vulnerability involves a core architectural flaw in the SignalR hub configuration, it significantly lowers the barrier for unauthorized parties to hijack a Covenant deployment. Defenders should prioritize patching or restricting access to the Covenant management interface.

Impact

Successful exploitation allows full administrative control over the Covenant C2 framework. An attacker can access all grunts, exfiltrate credentials gathered from target environments, modify or deploy malicious binaries, and retrieve operator roster and event history. This provides an attacker with the ability to maintain persistence, escalate privileges, and steal data harvested by the C2 platform.

Recommendation

  • Restrict network access to the Covenant management interface using network firewalls or VPNs until the software is updated.
  • Patch Covenant instances to a version addressing CVE-2026-92717 immediately.
  • Monitor SignalR traffic to the Covenant hub for unauthenticated calls to the 'CreateHttpListener' method.
]]>criticaladvisoryauthentication-bypassc2-infrastructurecve-2026-92717