CVE-2026-34042 - Vulnerability Analysis

Overview

act prior to 0.2.86 contains a remote code execution vulnerability caused by the built-in actions/cache server listening on all interfaces, letting remote attackers create and retrieve caches with arbitrary keys, exploit requires network access to the cache server.

Severity & Score

Impact

Remote attackers can execute arbitrary code within the Docker container by creating malicious caches.

Mitigation

Update to version 0.2.86 or later.

References

• https://code.forgejo.org/forgejo/runner/issues/294
• https://github.com/nektos/act/commit/c28c27e141e8b54f9853de82f421ee09846751f7
• https://github.com/nektos/act/releases/tag/v0.2.86
• https://github.com/nektos/act/security/advisories/GHSA-x34h-54cw-9825

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner