onyx --cves cve-2026-76847

CVE-2026-76847

score: 6.7
cvss: 8.8
epss: 0.4%
published: 2026-08-24
kev added: —
first seen: 2026-10-21

GitHub Actions HTTP Artifacts V4 backend contains an authentication bypass caused by improper validation of workflow_run_backend_id and use of a hardcoded weak HMAC key, letting remote attackers read, overwrite, or delete artifacts without credentials, exploit requires network access to the artifact server.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2026-08-24 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC https://github.com/nektos/act/blob/v0.2.89/cmd/root.go

Exploit availability

https://github.com/nektos/act/blob/v0.2.89/cmd/root.go
https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go

Weaknesses

CWE-321

References 4

https://github.com/nektos/act
https://github.com/nektos/act/blob/v0.2.89/cmd/root.go
https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go
https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend