CVE-2026-92717: Covenant Auth Bypass Vulnerability

CVE-2026-92717 Overview

Covenant is an open-source .NET-based command-and-control (C2) framework used by red teams for adversary emulation. In versions through 0.6, the CovenantHub SignalR hub is registered without an Authorize attribute. Unauthenticated network callers can invoke the CreateHttpListener method and receive a signed JSON Web Token (JWT). The returned token authenticates against the entire operator API, exposing grunts, credentials, binaries, events, and the operator roster. The flaw is tracked as missing authentication for a critical function [CWE-306].

Critical Impact

Any network-reachable attacker can obtain a valid operator JWT without credentials, then take full control of the Covenant C2 server and every implant it manages.

Affected Products

• Covenant C2 framework versions through 0.6
• CovenantHub SignalR hub component
• Covenant operator API endpoints consumed via issued JWT tokens

Discovery Timeline

• 2026-09-16 - CVE-2026-92717 published to the National Vulnerability Database
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92717

Vulnerability Analysis

Covenant exposes real-time operator functionality through a SignalR hub named CovenantHub. SignalR hubs in ASP.NET Core inherit authentication requirements from decorators or global middleware policies. The CovenantHub class is registered without an [Authorize] attribute, and no fallback policy enforces authentication on the hub route.

As a result, any client that can reach the Covenant listener over the network can open a SignalR connection and invoke server-side methods. One of those methods, CreateHttpListener, calls into CovenantService and returns a JWT signed with the server's operator signing key. That token is valid across the entire operator REST API.

Once an attacker holds a valid JWT, they can enumerate and control grunts (implants), read stored credentials harvested from victims, download attacker binaries and launchers, inspect event logs, and manipulate the operator roster. This effectively hands over control of the C2 infrastructure and every downstream compromised host.

Root Cause

The root cause is a missing authorization decorator on a hub that exposes privileged operations. Per the referenced source at Covenant/Hubs/CovenantHub.cs lines 28-33, the hub class is declared without [Authorize], while the underlying service method at Covenant/Core/CovenantService.cs lines 3958-3975 issues a fully privileged JWT to any caller. Trust boundaries collapse because the token-issuing method assumes the caller has already been authenticated by the hub layer.

Attack Vector

Exploitation requires only network reachability to the Covenant operator interface. An attacker establishes a SignalR client connection to the /covenantHub endpoint, invokes CreateHttpListener with attacker-controlled parameters, and receives a signed JWT in the response. The attacker then presents the JWT as a bearer token to Covenant's REST API to enumerate grunts, exfiltrate credentials, retrieve payload binaries, and add or modify operator accounts. No user interaction, prior credentials, or elevated privileges are required.

A public proof-of-concept and vendor-independent technical write-up are available in the VulnCheck Advisory on Covenant and GitHub Issue #406.

Detection Methods for CVE-2026-92717

Indicators of Compromise

• Unexpected SignalR negotiate or connect requests to /covenantHub from source addresses outside the operator network
• Invocations of the CreateHttpListener hub method from unauthenticated or unknown clients
• Newly issued JWTs in Covenant logs that were not initiated by a known operator login
• Creation of unfamiliar HTTP listeners, grunts, or operator accounts in the Covenant database
• Downloads of grunt binaries or credential exports without a corresponding authenticated operator session

Detection Strategies

• Inspect Covenant application logs for SignalR method invocations that precede any successful operator login
• Correlate JWT issuance events with authenticated web UI sessions and alert on mismatches
• Deploy network signatures for SignalR WebSocket traffic targeting /covenantHub from non-operator subnets
• Baseline the operator roster, listener list, and grunt inventory, and alert on unauthorized additions

Monitoring Recommendations

• Forward Covenant server logs, IIS or Kestrel access logs, and host process telemetry to a centralized analytics platform
• Monitor egress from the Covenant host for unexpected outbound connections that could indicate attacker takeover
• Track process creation and file writes under the Covenant installation directory for tampering
• Alert on operator API calls originating from IP addresses not on an approved allowlist

How to Mitigate CVE-2026-92717

Immediate Actions Required

• Restrict network access to the Covenant operator interface using firewall rules or a VPN, so only trusted operator hosts can reach the SignalR endpoint
• Take publicly exposed Covenant instances offline until they can be secured behind authenticated access controls
• Rotate any JWT signing keys, operator credentials, and implant staging keys that may have been exposed
• Review grunts, listeners, and operator accounts for unauthorized entries and remove them

Patch Information

No official patched release is identified in the referenced advisory. The upstream Covenant project is tracked at the GitHub Covenant Framework repository, with the vulnerable code paths documented at the GitHub Covenant Hub Code and GitHub Covenant Service Code references. Operators should monitor the project and the VulnCheck Advisory on Covenant for a fixed build or apply a local source-level fix.

Workarounds

• Apply an [Authorize] attribute to the CovenantHub class and rebuild from source to require authenticated SignalR connections
• Configure an ASP.NET Core global authorization fallback policy that denies anonymous access to all endpoints, including SignalR hubs
• Place the Covenant operator interface behind a reverse proxy that enforces mutual TLS or an additional authentication layer
• Bind the Covenant operator listener to localhost and require operators to tunnel in over SSH rather than exposing the port on any external interface