CVE-2026-34042

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://code.forgejo.org/forgejo/runner/issues/294
https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7
https://github.com/nektos/act/releases/tag/v0.2.86
https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825

Configurations

No configuration.

History

No history.

Information

Published : 2026-03-31 03:15

Updated : 2026-06-17 10:38

NVD link : CVE-2026-34042

Mitre link : CVE-2026-34042

CVE.ORG link : CVE-2026-34042

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-34042", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34042", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T18:50:28.267177Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nektos", "product": "act", "versions": [{"status": "affected", "version": "< 0.2.86"}]}]}], "published": "2026-03-31T03:15:58.220", "references": [{"url": "https://code.forgejo.org/forgejo/runner/issues/294", "source": "security-advisories@github.com"}, {"url": "https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7", "source": "security-advisories@github.com"}, {"url": "https://github.com/nektos/act/releases/tag/v0.2.86", "source": "security-advisories@github.com"}, {"url": "https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86."}, {"lang": "es", "value": "act es un proyecto que permite la ejecuci\u00f3n local de acciones de GitHub. Antes de la versi\u00f3n 0.2.86, el servidor actions/cache integrado de act escucha las conexiones en todas las interfaces y permite que cualquiera que pueda conectarse a \u00e9l, incluyendo a alguien desde cualquier lugar de internet, cree cach\u00e9s con claves arbitrarias y recupere todos los cach\u00e9s existentes. Si pueden predecir qu\u00e9 claves de cach\u00e9 ser\u00e1n utilizadas por las acciones locales, pueden crear cach\u00e9s maliciosos que contengan los archivos que deseen, lo que muy probablemente permitir\u00eda la ejecuci\u00f3n remota de c\u00f3digo arbitrario dentro del contenedor de Docker. Este problema ha sido parcheado en la versi\u00f3n 0.2.86."}], "lastModified": "2026-06-17T10:38:28.640", "sourceIdentifier": "security-advisories@github.com"}