CVE-2026-92717: Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker gain after exploiting this issue?
The attacker can obtain a signed JWT that authenticates to the entire operator API. This provides access to grunts, credentials, binaries, events, and the operator roster.
Does exploitation require an existing Covenant account or operator credentials?
No. The affected SignalR hub permits unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token.
Which Covenant deployments should be investigated?
Covenant versions through 0.6 are affected. Investigate deployments where the CovenantHub SignalR hub can be reached by unauthenticated network callers.