CVE-2026-34042: fallo de gravedad alta en nektos act
act: actions/cache server allows malicious cache injection
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.5%
act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Productos afectados
nektos · actCVEs relacionadas — nektos act
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-22726HIGHUnrestricted file upload leading to privilege escalation in actEPSS 1.3%CVE-2026-34041HIGHact: Unrestricted set-env and add-path command processing enables environment injectionEPSS 0.6%CVE-2026-76847HIGHact 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 BackendEPSS 0.4%