CVE-2026-76847

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89

Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact', 'GetSignedArtifactURL', 'ListArtifacts', 'FinalizeArtifact', and 'DeleteArtifact', accept a caller-supplied workflow run backend id without verifying if it belongs to the requester. This occurs because the validateRunIDV4() function in pkg/artifacts/artifacts v4.go parses the value but does not perform the necessary comparison against the requesting task's run ID. Additionally, signed URLs are authenticated using a hardcoded HMAC key (0xba 0xdb 0xee 0xf0), making signatures forgeable and ambiguous between different artifact name and task ID pairs. By default, the --artifact-server-addr flag uses the host's outbound address instead of the loopback address, making the backend reachable from the surrounding network. This allows unauthorized clients to read, overwrite, or delete artifacts of concurrently running jobs, potentially exposing secrets and deployment credentials.

Recommendations For versions 0.2.81 through 0.2.89, bind the artifact server to the loopback address and avoid using actions/upload-artifact@v4 and actions/download-artifact@v4 until a patch is available.