Nektos - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/nektos/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 24 Aug 2026 16:02:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass and Artifact Manipulation in 'act' HTTP Artifacts V4 Backendhttps://feed.craftedsignal.io/briefs/2026-08-act-artifacts-v4-auth-bypass/Mon, 24 Aug 2026 16:02:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-act-artifacts-v4-auth-bypass/The 'act' tool's HTTP Artifacts V4 backend suffers from an authentication bypass and hardcoded HMAC key vulnerability (CVE-2026-76847), allowing unauthorized network actors to access, modify, or delete artifacts and exfiltrate secrets.The 'act' tool, used for running GitHub Actions locally, exposes a critical security vulnerability (CVE-2026-76847) in its HTTP Artifacts V4 backend implementation. Introduced to support actions/upload-artifact@v4 and actions/download-artifact@v4, this backend fails to validate the workflow_run_backend_id parameter against the requesting task, essentially disabling access control. Furthermore, the backend uses a static, hardcoded four-byte HMAC key (0xba 0xdb 0xee 0xf0) for signing artifact URLs. The flawed construction of these signatures, combined with the fact that the artifact server defaults to listening on all network interfaces rather than loopback, allows any reachable attacker to read, overwrite, or delete build artifacts. This vulnerability enables the theft of sensitive data such as hardcoded secrets, API keys, or deployment credentials, and allows attackers to inject malicious files into the CI/CD pipeline of a target machine.

Impact

Successful exploitation allows for the complete compromise of CI/CD build outputs handled by the 'act' tool. Unauthorized actors can exfiltrate sensitive environment variables, deployment tokens, and build artifacts, or manipulate files to facilitate supply-chain attacks on build processes. Given the hardcoded key and lack of network binding restrictions, any attacker with network visibility to the host running 'act' can perform these operations without credentials.

Recommendation

Prioritized, concrete actions for detection engineering and security teams:

  • Update the 'act' tool to the latest patched version immediately to resolve CVE-2026-76847.
  • Inspect existing network configurations for hosts running 'act'; ensure that artifact server ports are not exposed to untrusted networks.
  • Implement network-level egress and ingress filtering to restrict access to the 'act' artifact server port (typically configured via --artifact-server-addr) to localhost only.
  • Audit CI/CD logs for unauthorized access to artifact endpoints or unexpected artifact modification events if the tool was previously deployed in a shared or non-isolated environment.
]]>highadvisory