CVE-2026-92717CWE-306

CVE-2026-92717

Critical · published September 16, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00495 · 41.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-16T22:17Z
References (6)
https://github.com/cobbr/Covenant · [email protected]https://github.com/cobbr/Covenant/blob/v0.6/Covenant/Core/CovenantService.cs#L3958-L3975 · [email protected]https://github.com/cobbr/Covenant/blob/v0.6/Covenant/Hubs/CovenantHub.cs#L28-L33 · [email protected]https://github.com/cobbr/Covenant/issues/406 · [email protected]https://www.vulncheck.com/advisories/covenant-through-0.6-missing-authentication-on-the-covenanthub-signalr-hub · [email protected]https://github.com/cobbr/Covenant/issues/406 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 17:31Z
    Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub
    cvelistv5