The vulnerability in nektos act arises from the HTTP Artifacts V4 backend starting whenever workflows use certain artifact actions. Control-plane RPCs accept a workflow_run_backend_id parameter but do not verify that it belongs to the requester because the relevant validation code is commented out. Additionally, the signed URLs use an HMAC with a hardcoded 4-byte key (0xba 0xdb 0xee 0xf0) that is identical across builds and computed over concatenated parameters without delimiters, making signatures forgeable and ambiguous. The artifact server listens on the host's outbound address by default rather than loopback, exposing it to the network. Consequently, any client with network access can access or manipulate artifacts of running jobs without authentication, potentially exposing secrets and allowing artifact replacement.

An attacker with network access to the artifact server can bypass authorization controls to read, overwrite, or delete artifacts belonging to concurrent jobs. This can lead to exposure of sensitive build outputs such as secrets and deployment credentials, and allow tampering with artifacts before the owning job consumes them. The vulnerability affects confidentiality, integrity, and availability of build artifacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the artifact server by configuring the --artifact-server-addr flag to bind to loopback or a trusted interface. Monitor for updates from the vendor regarding an official fix or temporary mitigations.