Vulnerability Description
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/cobbr/Covenant
- https://github.com/cobbr/Covenant/blob/v0.6/Covenant/Core/CovenantService.cs#L39
- https://github.com/cobbr/Covenant/blob/v0.6/Covenant/Hubs/CovenantHub.cs#L28-L33
- https://github.com/cobbr/Covenant/issues/406
- https://www.vulncheck.com/advisories/covenant-through-0.6-missing-authentication
FAQ
What is CVE-2026-92717?
CVE-2026-92717 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can u...
How severe is CVE-2026-92717?
CVE-2026-92717 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-92717?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.