CVE-2026-92717
CriticalCVSS 9.1Summary
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.
Risk Assessment
An unauthenticated attacker can gain full access to the operator API, including sensitive data and functions. This may lead to takeover of the Covenant infrastructure.
Recommendation
Immediately update Covenant to a version later than 0.6 if available, and add the Authorize attribute to the CovenantHub. Until patched, restrict network access to the SignalR hub.
Other vulnerabilities in Covenant
Original NVD description (English source)
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.