Which versions of Covenant are affected by CVE-2026-92717?

Covenant through 0.6 contains a critical missing authentication flaw in its CovenantHub endpoint that lets any unauthenticated attacker with network reachability obtain operator-level access to the…

How to fix or mitigate CVE-2026-92717?

Within 24 hours, restrict network access to the Covenant operator server and CovenantHub endpoint to trusted administrative IP ranges via firewall, security group, or reverse-proxy allowlisting; if Covenant through 0.6 is not essential, take the server offline or disable the SignalR hub; enable logging and alerting for CreateHttpListener invocations, unexpected JWT issuance, and new operator creation. Within 7 days, place authentication and access controls in front of the CovenantHub endpoint, for example mutual TLS or an authenticating reverse proxy; audit Covenant instances for unauthorized grunts, credentials, binaries, events, and operator accounts; rotate all Covenant-issued JWTs and any secrets exposed through the operator API; and confirm no internet-facing or non-default deployments remain. Within 30 days, upgrade to a vendor-released fixed version beyond Covenant 0.6 once available; if no patch is published, migrate critical operations to a supported alternative C2 platform, implement permanent network segmentation and strict allowlisting for all Covenant management interfaces, and conduct a full compromise assessment and credential rotation.

Covenant CVE-2026-92717

Q: What is the CVSS score of CVE-2026-92717?

CVE-2026-92717 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80900 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-09-16 VulnCheck

GHSA-h9hg-x52x-c465

Authentication Bypass Covenant Cobbr

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Unauthenticated remote hub call (AV:N/AC:L/PR:N/UI:N) yields a JWT granting full operator API read and listener creation (C:H/I:H); no direct availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 18:40 vuln.today

tag: Cobbr added

Analysis Generated

Sep 16, 2026 - 18:07 vuln.today

CVE Published

Sep 16, 2026 - 17:31 cve.org

CRITICAL 9.3

DescriptionCVE.org

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.

AnalysisAI

Covenant through 0.6 registers its CovenantHub SignalR hub without an Authorize attribute, so any unauthenticated caller who can reach the hub endpoint can invoke CreateHttpListener and receive a valid signed JWT; that token then authenticates the attacker to the entire Covenant operator API, exposing grunts, credentials, binaries, events, and the operator roster. The vulnerability is scored CVSS 4.0 9.3 and independently assessed as CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), fully compromising confidentiality and integrity with no availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions beyond network reachability - the CovenantHub SignalR hub in Covenant through 0.6 is registered without an Authorize attribute, so any unauthenticated caller who can reach the hub endpoint can invoke CreateHttpListener and mint a valid JWT against a default installation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority authentication flaw, not a CVSS-inflated paper risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch identified at time of analysis; GitHub issue 406 and the VulnCheck advisory document the flaw but do not cite a fixed Covenant release. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, restrict network access to the Covenant operator server and CovenantHub endpoint to trusted administrative IP ranges via firewall, security group, or reverse-proxy allowlisting; if Covenant through 0.6 is not essential, take the server offline or disable the SignalR hub; enable logging and alerting for CreateHttpListener invocations, unexpected JWT issuance, and new operator creation. …

Threat intelligence, references, and detailed analysis are available after sign-in.