CVE-2026-34042
published 2026-03-31CVE-2026-34042: act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all…
PriorityP352high8.2CVSS 3.1
AVNACLPRNUIRSCCHILAN
EPSS
0.58%
45.4th percentile
act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can create malicious caches containing whatever files they please most likely allowing arbitrary remote code execution within the docker container. This issue has been patched in version 0.2.86.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | nektos_act | >= 0 < 0.2.86 | 0.2.86 |
| nektos | act | < 0.2.86 | 0.2.86 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
act: actions/cache server allows malicious cache injection in github.com/nektos/act
osv·2026-04-02
CVE-2026-34042 act: actions/cache server allows malicious cache injection in github.com/nektos/act
act: actions/cache server allows malicious cache injection in github.com/nektos/act
act: actions/cache server allows malicious cache injection in github.com/nektos/act
GHSA
act: actions/cache server allows malicious cache injection
ghsa·2026-03-27
CVE-2026-34042 [HIGH] CWE-862 act: actions/cache server allows malicious cache injection
act: actions/cache server allows malicious cache injection
act's built-in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it — including someone anywhere on the internet — to create caches with arbitrary keys and retrieve all existing caches. If one can predict which cache keys will be used by local actions, one can create malicious caches containing whatever files one pleases, most likely allowing arbitrary remote code execution within the Docker container.
## Discovery
Discovered while discussing [forgejo/runner#294](https://code.forgejo.org/forgejo/runner/issues/294).
## Proposed Mitigation
It was discussed to append a secret to `ACTIONS_CACHE_URL` to retain compatibility with GitHub's cache action and still allow authorization. Fo
OSV
act: actions/cache server allows malicious cache injection
osv·2026-03-27
CVE-2026-34042 [HIGH] act: actions/cache server allows malicious cache injection
act: actions/cache server allows malicious cache injection
act's built-in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it — including someone anywhere on the internet — to create caches with arbitrary keys and retrieve all existing caches. If one can predict which cache keys will be used by local actions, one can create malicious caches containing whatever files one pleases, most likely allowing arbitrary remote code execution within the Docker container.
## Discovery
Discovered while discussing [forgejo/runner#294](https://code.forgejo.org/forgejo/runner/issues/294).
## Proposed Mitigation
It was discussed to append a secret to `ACTIONS_CACHE_URL` to retain compatibility with GitHub's cache action and still allow authorization. Fo
No detection rules found.
No public exploits indexed.
2026-03-31
Published