Arbitrary Code Execution Vulnerability in act Project by Nektos

CVE-2026-34042

What is CVE-2026-34042?

The act project, which facilitates local execution of GitHub Actions, has a serious vulnerability affecting versions prior to 0.2.86. Its actions/cache server, as configured before this patch, was accessible via all network interfaces. This configuration allowed any remote user to connect and create malicious caches. If an attacker could predict the cache keys used by local actions, they could store harmful files within these caches, leading to possible arbitrary remote code execution within the Docker container. This vulnerability was addressed in version 0.2.86, which implements measures to prevent unauthorized access to the cache server.

References