CVE-2026-34042 Details
Description
act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86.
A remote code execution vulnerability has been identified in Nektos Act versions through 0.2.85. The issue arises from the built-in actions/cache server, which listens on all interfaces without restriction. This allows anyone, including individuals on the internet, to create caches with arbitrary keys and access existing caches. If a user can predict the cache keys used by local actions, they can inject malicious caches containing any files, potentially leading to arbitrary remote code execution within the Docker container.
Users can upgrade to Nektos Act version 0.2.86 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 31, 2026CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://code.forgejo.org/forgejo/runner/issues/294 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7 | [email protected] | Source CodeVendor |
| https://github.com/nektos/act/releases/tag/v0.2.86 | [email protected] | Release NotesVendor |
| https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825 | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nektos act | <= 0.2.85 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |