CVE-2026-76847: Missing Authorization in nektos act

The nektos act tool starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. This backend's control-plane RPCs accept a workflow_run_backend_id supplied by the caller but do not verify that it belongs to the requester because the relevant validation code is commented out. The signed URLs issued for artifact access use an HMAC with a hardcoded 4-byte key (0xba 0xdb 0xee 0xf0), which is identical across builds and computed over concatenated parameters without delimiters, making signatures forgeable and ambiguous. The backend listens on the host's outbound address by default, exposing it to the surrounding network. Consequently, any client able to reach the backend can read, overwrite, or delete artifacts of running jobs without credentials, risking exposure and tampering of sensitive build artifacts.

An attacker with network access to the artifact backend can bypass authorization controls to read, modify, or delete artifacts belonging to other concurrent jobs. This can lead to exposure of sensitive build outputs such as secrets and deployment credentials, as well as tampering with artifacts before they are consumed by the owning job. The weak HMAC key and lack of proper validation exacerbate the risk by allowing signature forgery and unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the artifact backend by configuring the --artifact-server-addr flag to bind to localhost or a trusted interface. Monitor for updates from the nektos project regarding an official fix or temporary mitigations.