CVE-2026-76847: act HTTP Artifacts Backend Information Disclosure

CVE-2026-76847 is an information disclosure flaw in act HTTP Artifacts V4 backend that allows unauthorized access to workflow artifacts. Attackers can read, modify, or delete build outputs including secrets and credentials. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-76847 Overview

CVE-2026-76847 is a missing authorization vulnerability in act, the tool that runs GitHub Actions workflows locally. When a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4, act starts an HTTP Artifacts V4 backend. The control-plane RPCs accept a caller-supplied workflow_run_backend_id without verifying ownership, and signed URLs rely on a hardcoded four-byte HMAC key. The --artifact-server-addr flag defaults to the host's outbound address, exposing the backend to the adjacent network. Any reachable client can read, overwrite, or delete artifacts of a concurrent job.

Critical Impact
Unauthenticated adjacent-network attackers can steal or replace build artifacts, including secrets and deployment credentials, before the owning workflow consumes them.

Affected Products

nektos/act (Artifacts V4 backend)
act version v0.2.89 and prior versions with V4 artifact support
Workflows invoking actions/upload-artifact@v4 or actions/download-artifact@v4

Discovery Timeline

2026-08-24 - CVE-2026-76847 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76847

Vulnerability Analysis

The flaw combines two defects in pkg/artifacts/artifacts_v4.go. First, the validateRunIDV4 function parses a caller-supplied workflow_run_backend_id and returns it, but the comparison against the requesting task's run ID is commented out. Every control-plane RPC accepts the parsed value without an ownership check, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact, and DeleteArtifact.

Second, the backend signs artifact URLs with an HMAC keyed on the constant four bytes 0xba 0xdb 0xee 0xf0. The key is identical in every build. The signed payload concatenates endpoint, expiry, artifact name, and task ID without length prefixes or delimiters, so signatures are both forgeable and ambiguous between distinct name and task ID pairs. The vulnerability maps to [CWE-321: Use of Hard-coded Cryptographic Key].

Root Cause

The root cause is a hardcoded HMAC key paired with disabled authorization logic on artifact RPCs. The signature scheme also lacks canonicalization, allowing input collisions across differing artifact identifiers.

Attack Vector

An attacker on the same network segment reaches the artifact server, which binds to the host's outbound address by default rather than loopback. The attacker enumerates or guesses workflow_run_backend_id values and issues RPCs directly, or forges signed URLs using the known HMAC key. This yields unauthenticated read, write, and delete access to artifacts of concurrently running jobs, exposing secrets and enabling artifact replacement before consumption.

See the VulnCheck Security Advisory and the GitHub Artifacts Implementation for technical details.

Detection Methods for CVE-2026-76847

Indicators of Compromise

Artifact server processes listening on non-loopback interfaces on developer or CI hosts running act
Unexpected CreateArtifact, FinalizeArtifact, or DeleteArtifact HTTP requests in act runtime logs
Modified or missing artifact contents between upload and download steps within the same workflow run

Detection Strategies

Monitor for act binaries binding TCP sockets to routable addresses instead of 127.0.0.1
Alert on inbound connections to the act artifact server port from hosts other than the workflow container network
Inspect workflow logs for artifact operations referencing workflow_run_backend_id values that do not match the executing task

Monitoring Recommendations

Baseline expected artifact upload and download counts per workflow and flag deviations
Capture and retain HTTP access logs from the act artifact backend for forensic review
Track process command-line arguments containing --artifact-server-addr to identify exposed listeners

How to Mitigate CVE-2026-76847

Immediate Actions Required

Restrict act to trusted hosts and avoid running it on shared networks until a patched release is deployed
Explicitly bind the artifact server to loopback using --artifact-server-addr 127.0.0.1
Rotate any secrets or deployment credentials that may have transited artifacts on exposed act instances
Isolate CI runners executing act on a dedicated network segment with strict host firewall rules

Patch Information

No fixed version is listed in the NVD entry at time of publication. Track the nektos/act GitHub project for a release addressing the missing authorization and hardcoded HMAC key. Review the act root command source to confirm the default bind address in your deployed version.

Workarounds

Set --artifact-server-addr 127.0.0.1 on every invocation to prevent adjacent-network exposure
Block inbound traffic to the artifact server port at the host firewall
Avoid running multiple act workflows concurrently on the same host to eliminate cross-run interference

bash

# Configuration example: bind the act artifact server to loopback only
act --artifact-server-addr 127.0.0.1 --artifact-server-port 34567

# Host firewall rule (Linux) restricting the artifact port to localhost
sudo iptables -A INPUT -p tcp --dport 34567 ! -s 127.0.0.1 -j DROP