A critical authorization vulnerability in nektos act allows unauthenticated remote attackers to manipulate cache data and achieve remote code execution.

The vulnerability exists due to a missing authorization check in the built in actions cache server, which binds to all network interfaces. This allows an unauthenticated attacker to interact with the cache server to retrieve existing caches or inject malicious files that may be executed by local actions.

This vulnerability poses a severe risk to development environments relying on nektos act. An attacker can compromise the integrity of the build process by injecting malicious files or gain unauthorized access to sensitive cached data. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to full system compromise of the containerized environment.

Immediate Action: Upgrade the nektos act package to version 0.2.86 or later immediately to apply the necessary authorization controls.

Proactive Monitoring: Review network access logs for the cache server port to identify unexpected connection attempts from untrusted sources.

Compensating Controls: If an immediate update is not feasible, ensure that the act cache server is restricted to localhost via firewall rules or host-level access control lists to prevent external network exposure.

Public Exploit Available: No (exploit_available: unknown)

The ability for an unauthenticated remote attacker to inject arbitrary files into the build cache is a significant security failure. Security teams must prioritize upgrading to version 0.2.86 across all development workstations and CI/CD runners where act is deployed. Failure to patch this vulnerability leaves local build pipelines susceptible to supply chain poisoning and remote code execution.