Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Covenant lets anyone obtain admin token via hub

CVE-2026-92717 · published 25 days ago
Summary

In Covenant versions up to 0.6, the CovenantHub SignalR hub does not require a login, so anyone can request a token and receive a signed JWT. With that token they can access the full operator interface, including agents, stored credentials, files, event logs, and user lists. Apply the latest update or add proper authentication checks to the hub to stop unauthorized access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cobbr covenant <= 0.6
Original advisory text
Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published16 Sep 2026
Updated11 Oct 2026
First seen16 Sep 2026
Sources
CVE-2026-92717 · NVD
CVE-2026-92717 · MITRE
CVE-2026-92717 · OSV
Track software like this
Free during beta