CVE-2026-76847
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out.
Risk Assessment
The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, making signatures forgeable and ambiguous. Additionally, the backend is reachable from the network by default, allowing any client to read, overwrite or delete artifacts of a concurrently running job with no credentials, potentially exposing secrets and deployment credentials.
Recommendation
Apply a patch that restores run ID validation, uses a random HMAC key, and defaults the server address to loopback, and restrict network access to the backend.
Related vulnerabilities
- CVE-2026-120240Critical
A vulnerability was found in the WAVLINK WN553X1-B device (version V260403_2.0.0) in the sub_41A748 function of /bin/ioos, part of the WireGuard CLI Group Handler. Manipulating the group_id/group_name arguments can lead to OS command injection. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-120239Critical
A vulnerability was found in WAVLINK WN553X1-B (V260403_2.0.0) in the sub_419DA8 function of /bin/ioos, within the WireGuard CLI Handler component. Manipulating the file_id argument leads to OS command injection. The attack can be carried out remotely and the exploit has been made public.
- CVE-2026-120238Critical
A vulnerability has been found in WAVLINK WN553X1-B (260403_2.0.0) in the sub_4162A8 function of /bin/ioos, within the ovpn_file Handler component. Manipulating the file_id argument leads to OS command injection. The attack can be executed remotely and the exploit has been disclosed to the public.
- CVE-2026-62048Critical
The BookIt plugin (Liquid Web / StellarWP) contains an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions up to and including 2.6.0.6.
- CVE-2026-120338Critical
The Generative UI sandbox in prefab-ui runs caller-supplied Python inside Pyodide (WebAssembly) in a Deno subprocess, but from 0.14.0 through 0.20.2 Deno starts with unrestricted --allow-read, --allow-write, and --allow-net, and the Deno API remains on the JavaScript global object. This lets Python call Deno.readTextFileSync and Deno.writeTextFileSync, enabling file read/write as the server OS user and persistent code execution via a .pth file in site-packages.
- CVE-2026-120231Critical
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0 in the function sub_416568 of /bin/ioos, part of the OpenVPN CLI Handler. Manipulating the file_id argument leads to OS command injection. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-120230Critical
A vulnerability was found in WAVLINK WN701AE 260105 in the function del_vlan_group of the ioos Web Backend. Manipulating the vlan_name argument results in OS command injection. The attack may be performed remotely and the exploit has been made public.
- CVE-2026-120229Critical
A vulnerability was found in WAVLINK WN553X1-B version 260403_2.0.0 affecting the sub_416B50 function in /bin/ioos. Manipulation of the file_id argument leads to OS command injection. The attack can be carried out remotely and the exploit has been publicly disclosed.
- CVE-2026-120228Critical
A flaw was found in WAVLINK WN553X1-B version V260403_2.0.0 affecting the sub_416D88 function in /bin/ioos (ioos Service component). Manipulation of the group_id/group_name arguments can lead to OS command injection. The attack can be executed remotely and the exploit has been published.
- CVE-2026-120308Critical
In Beta9, a tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration, without checking that the identifier names a volume owned by that workspace. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, which is bind-mounted read-write into the sandbox, allowing read and write access to the worker's files, including other tenants' volumes.
Original NVD description (English source)
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS