Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92717Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub

Critical 9.1

In plain English

A critical-severity missing authentication in Covenant from cobbr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 57.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.

Affected products (as reported)

Vendor	Product	Versions
cobbr	Covenant	0 – through 0.6

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Issue #406 issue-tracking
https://github.com/cobbr/Covenant product
https://github.com/cobbr/Covenant/blob/v0.6/Covenant/Hubs/CovenantHub.cs#L28-L33 technical-description
https://github.com/cobbr/Covenant/blob/v0.6/Covenant/Core/CovenantService.cs#L3958-L3975 technical-description
VulnCheck Advisory: Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub third-party-advisory