CVE-2026-76847

act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

Published Aug 24, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them.

Analysis

Technical impact

An artifact backend is started by act when a workflow references actions/upload-artifact@v4 or actions/download-artifact@v4. The backend’s RPC endpoints—CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact, and DeleteArtifact—accept a caller‑supplied workflow_run_backend_id but never verify that it matches the requester, as the validateRunIDV4 check is commented out, constituting a CWE‑862 (Missing Authorization) weakness. Signed URLs are generated with a hard‑coded four‑byte key (0xBA 0xDB 0xEE 0xF0) common to all builds and is computed over an endpoint string, expiry, artifact name, and task ID with no length delimiters, which gives rise to a CWE‑321 (Hardcoded Cryptographic Key) problem and makes the signature both forgeable and ambiguous. The default address for the artifact server is the host’s outbound IP instead of loopback, so any client that can reach the host may read, overwrite, or delete artifacts of concurrent jobs without credentials. These artifacts can contain secrets, deployment keys, or code to be executed by the running job, allowing an attacker to exfiltrate sensitive data or inject malicious build steps before the job processes them.

Affected Systems

The vulnerability affects the open‑source project act by nektos, specifically versions 0.2.81 through 0.2.89. Users of these releases that enable the v4 artifact backend are at risk.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS is not available, but the lack of authentication (CWE‑862) and the default network exposure make exploitation likely in environments where an attacker can reach the host. The hard‑coded key (CWE‑321) means that attackers can forge signed URLs to download, overwrite, or delete artifacts without any credentials, directly compromising confidentiality, integrity, and availability. It is not currently listed in CISA’s KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

nektos

act

unaffected

Version	Status	Constraints
`0.2.81`	affected	≤ 0.2.89

No data.

Vendor Product Versions

Nektos

Act

Version	Status	Scheme	Platform
`[0.2.81,0.2.89]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade act to version 0.2.90 or later, where the artifact backend now includes workflow run ID validation to address the CWE‑862 weakness and uses a securely generated HMAC key to resolve the CWE‑321 issue.
Reconfigure the --artifact-server-addr flag to bind only to the loopback interface (127.0.0.1) to prevent external access to the artifact server.
Apply network firewall rules or container isolation to block incoming connections to the artifact server port from untrusted hosts.

Generated by OpenCVE AI on August 24, 2026 at 17:47 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.351% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/nektos/act
https://github.com/nektos/act/blob/v0.2.89/cmd/root.go
https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go
https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend

History

Aug 28, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 1:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them.
Title		act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend
First Time appeared		Nektos Nektos act
Weaknesses		CWE-321 CWE-862
CPEs		cpe:2.3:a:nektos:act::::::::
Vendors & Products		Nektos Nektos act
References		https://github.com/nektos/act https://github.com/nektos/act/blob/v0.2.89/cmd/root.go https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`