CVE-2026-76847 nektos CVE debrief

Who should care

Defenders responsible for CI/CD pipelines using GitHub Actions and the act workflow should assess their exposure and prioritize remediation. They should verify and remediate this vulnerability in their CI/CD pipelines, especially those using GitHub Actions and the act workflow.

Why it matters

CVE-2026-76847 is a high-severity vulnerability in the act workflow that allows unauthorized access and manipulation of build artifacts, potentially exposing sensitive information and requiring immediate remediation.

• Potential unauthorized access to build artifacts
• Potential manipulation of build artifacts
• Exposure of sensitive information such as secrets and deployment credentials
• Need for verification of affected versions and remediation

Technical summary

The act workflow has a high-severity vulnerability (CVE-2026-76847) that allows unauthorized access and manipulation of build artifacts due to missing authorization and authentication in the Artifacts V4 backend. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their CI/CD pipelines, especially those using GitHub Actions and the act workflow.

Recommended defensive actions

• Verify and remediate this vulnerability in CI/CD pipelines using GitHub Actions and the act workflow.
• Implement proper authorization and authentication for the Artifacts V4 backend.
• Use secure HMAC keys and ensure the --artifact-server-addr flag is set to loopback.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source references indicate a high-severity vulnerability in the act workflow, which could allow unauthorized access and manipulation of build artifacts. The vulnerability is caused by missing authorization and authentication in the Artifacts V4 backend. The signed URLs issued by the backend are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.