EUVD-2026-80900
GHSA-h9hg-x52x-c465
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Covenant SignalR hub over network
-
DeliveryInvoke CreateHttpListener unauthenticated
-
ExploitReceive signed JWT token
-
ExecutionAuthenticate to operator API
-
ImpactExfiltrate grunts, credentials, and binaries
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the CovenantHub SignalR hub in Covenant through 0.6 is registered without an Authorize attribute, so any unauthenticated caller who can reach the hub endpoint can invoke CreateHttpListener and mint a valid JWT against a default installation. The limiting factor is exposure: the attacker must have network access to the operator server's SignalR/hub port. There is no user interaction, no authentication, and no non-default configuration required; exploitation is blocked only by network segmentation isolating the operator server. |
| Impact | This is a genuine high-priority authentication flaw, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) is consistent with the description: the CovenantHub SignalR hub is registered with no Authorize attribute, so an unauthenticated network attacker can invoke CreateHttpListener and receive a validly-signed JWT that unlocks the full operator API (grunts, credentials, binaries, events, operator roster). PR:N is well-supported here - the whole point of the bug (CWE-306, missing authentication for a critical function) is that no credentials are needed, and the linked source lines (CovenantHub.cs L28-33, CovenantService.cs L3958-3975) substantiate the mechanism. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or automated weaponization; the confirmation of the issue is a code-level advisory from VulnCheck plus the upstream GitHub issue #406. The tempering factor is prevalence and exposure model rather than exploitability: Covenant is a niche red-team C2 framework, and impact is heavily conditioned on whether the operator server/hub port is reachable by the attacker. Where a Covenant server is exposed, this is effectively a full compromise of the C2 tenant; where it is on an isolated operator network, real-world risk drops sharply. |
| Exploit ScenarioDerived | An attacker who can reach a Covenant operator server's SignalR endpoint connects to the CovenantHub without any credentials and calls CreateHttpListener, which returns a signed JWT. Using that token, the attacker authenticates to the operator API and reads grunts, harvested credentials, binaries, events, and the operator roster - effectively hijacking the C2 tenant. No public exploit is identified at time of analysis, but the flaw is documented at the source-code level by VulnCheck. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Covenant through 0.6 registers its CovenantHub SignalR hub without an Authorize attribute, so any unauthenticated caller who can reach the hub endpoint can invoke CreateHttpListener and receive a valid signed JWT; that token then authenticates the attacker to the entire Covenant operator API, exposing grunts, credentials, binaries, events, and the operator roster. The vulnerability is scored CVSS 4.0 9.3 and independently assessed as CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), fully compromising confidentiality and integrity with no availability impact. Exploitation requires only network reachability to the operator server - no credentials, user interaction, or non-default configuration - and while no public exploit identified at time of analysis and no CISA KEV listing was observed, the missing authentication check makes abuse straightforward for anyone with that access.
RemediationAI
No vendor-released patch identified at time of analysis; GitHub issue 406 and the VulnCheck advisory document the flaw but do not cite a fixed Covenant release. The most reliable mitigation is network isolation: bind the Covenant operator server to a trusted management network or VPN and firewall the SignalR/hub endpoint so only authorized operator workstations can reach it, accepting that this blocks all remote C2 management until access is restored. Alternatively, front the hub with an authenticating reverse proxy (mTLS or HTTP authentication) that rejects unauthenticated requests before they reach CovenantHub, but note that this can break legitimate SignalR clients that do not present credentials and requires careful WebSocket/upgrade handling. Organizations that build Covenant from source can add an [Authorize] attribute to CovenantHub and the token-issuing methods - a code-level fix, not an official release - and recompile. Finally, monitor operator server logs for unexpected CreateHttpListener invocations or JWT issuance from unknown source addresses, since these indicate exploitation attempts. See https://github.com/cobbr/Covenant/issues/406 and https://www.vulncheck.com/advisories/covenant-through-0.6-missing-authentication-on-the-covenanthub-signalr-hub for tracking.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Covenant is a .NET/C
command-and-control (C2) framework maintained by cobbr, whose operator console exposes a SignalR hub (CovenantHub) alongside an operator API that relies on JWT bearer authentication. In versions through 0.6, the CovenantHub hub is registered without the [Authorize] attribute (see Covenant/Hubs/CovenantHub.cs lines 28-33), so ASP.NET Core SignalR does not require an authenticated principal before dispatching hub method calls. The CreateHttpListener hub method (Covenant/Core/CovenantService.cs lines 3958-3975) mints and returns a signed JWT, effectively turning the hub into an unauthenticated token-issuance endpoint and the trust anchor for the entire operator API. CWE-306 (Missing Authentication for Critical Function) captures the root cause: a security-critical function - JWT issuance for the operator API - is reachable without any authentication check. The CPE cpe:2.3:a:cobbr:covenant:*:*:*:*:*:*:*:* confirms all Covenant releases up to and including 0.6 are in scope, and the flaw is reachable over the network through the same HTTP/WebSocket interface used by legitimate SignalR clients.
Know when Covenant gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Unauthenticated remote hub call (AV:N/AC:L/PR:N/UI:N) yields a JWT granting full operator API read and listener creation (C:H/I:H); no direct availability impact (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.
Executive ViewAI
Covenant through 0.6 contains a critical missing authentication flaw in its CovenantHub endpoint that lets any unauthenticated attacker with network reachability obtain operator-level access to the entire command-and-control platform. Because this platform manages compromised endpoints, credentials, payloads, and operator identities, a successful attack could expose sensitive security operations, enable adversary control of managed systems, and require extensive incident response and rebuild efforts. Leadership should treat this as an urgent operational risk and prioritize immediate containment and network restriction until a vendor fix is available.
No vendor-released patch identified at time of analysis; restrict network reachability to the Covenant operator server and CovenantHub endpoint to trusted management networks, require authentication at a reverse proxy or API gateway, disable or isolate Covenant/Hub if not essential, monitor for unauthorized CreateHttpListener calls and JWT issuance, and rotate exposed credentials and tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB