EUVD-2026-64852
GHSA-crfw-6q9f-w49f
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A because default binding exposes backend to local network only; PR:N because authorization check is entirely absent; full C/I/A impact on artifact data.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them.
AnalysisAI
Unauthenticated artifact manipulation in nektos/act's Artifacts V4 backend allows any network-adjacent attacker to read, overwrite, or delete the build artifacts of concurrently running jobs, including embedded secrets and deployment credentials. Two compounding root-cause defects drive the severity: a run-ID ownership check that is explicitly commented out in validateRunIDV4 (pkg/artifacts/artifacts_v4.go), and a universally forgeable HMAC whose key is a hardcoded 4-byte constant (0xba 0xdb 0xee 0xf0) shared across every build with a delimiter-free concatenation scheme vulnerable to hash ambiguity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The artifact backend is only started when the workflow being executed by act includes a step that invokes actions/upload-artifact@v4 or actions/download-artifact@v4 - workflows that do not use these specific actions are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H is well-calibrated: the AV:A (Adjacent) metric is the primary limiting factor, meaning exploitation requires the attacker to be on the same local network segment or the same host as the act process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the same local network or host as a developer or CI agent running act waits for a job that invokes actions/upload-artifact@v4 to begin, identifies the artifact backend's address from the act process's bound outbound interface, and forges a valid HMAC signature for a ListArtifacts RPC by computing the 4-byte hardcoded key (0xba 0xdb 0xee 0xf0) over the known concatenation scheme. The attacker calls GetSignedArtifactURL with an arbitrary workflow_run_backend_id to retrieve a signed URL for the victim job's artifacts containing deployment tokens or compiled binaries, exfiltrates the secrets, and optionally calls CreateArtifact or FinalizeArtifact to replace the artifact with a malicious payload before the owning job downloads it. … |
| Remediation | No vendor-released patched version has been independently confirmed from the available reference data - the GitHub repository (https://github.com/nektos/act) and VulnCheck advisory (https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend) should be monitored for a patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running nektos/act, audit artifact backend access logs for suspicious activity, and implement immediate network segmentation restricting artifact storage access to authorized internal services. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today