A missing authorization vulnerability in the nektos act tool allows unauthorized access to the Artifacts V4 backend, creating a risk of data manipulation or exposure.

This vulnerability involves a missing authorization check (CWE-862) and the use of hard-coded cryptographic keys (CWE-321) within the HTTP Artifacts V4 backend implementation. It is an unauthenticated vulnerability accessible via the adjacent network.

The ability for an attacker to interact with the artifacts backend without authorization could lead to the unauthorized access, modification, or deletion of build artifacts. With a CVSS score of 8.8, this represents a significant threat to the integrity of CI/CD pipelines and the software supply chain.

Immediate Action: Upgrade the nektos act tool to a version beyond 0.2.89 as soon as the vendor provides a security patch.

Proactive Monitoring: Audit CI/CD workflow logs for unexpected access attempts or modifications to artifact storage directories.

Compensating Controls: Restrict network access to the host machine running the act tool to trusted segments only, effectively isolating the service from unauthorized adjacent network traffic.

Public Exploit Available: No

Given the potential for supply chain compromise, users of nektos act should monitor the project repository for immediate updates. Until a fix is deployed, ensure that build runners are isolated from untrusted network segments to prevent unauthorized access to the artifacts backend.