CVE-2026-92717
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.
- Published Sep 16, 2026
- CVSS 9.3 critical
- 0.5% chance of exploitation in the next 30 days (EPSS)