CovenantHub SignalR Hub Vulnerability: Critical CVE-2026-92717
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- covenanthub (npm)
- Affected versions
- >= v0.6, <= v0.6 or >= v0.3, <= v0.3 or >= v0.1.2, <= v0.1.2 or >= v0.1.1, <= v0.1.1 or >= v0.1, <= v0.1
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the CovenantHub SignalR hub in Covenant through version 0.6. This vulnerability allows unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token, potentially compromising sensitive information.
What happened
An early warning has been issued for a critical vulnerability in the CovenantHub SignalR hub in Covenant through version 0.6. This vulnerability, tracked as CVE-2026-92717, is registered without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use this token to authenticate against the entire operator API and access sensitive information. The vulnerability is reportedly severe, with a CVSS score of 9.1.
The affected components include covenanthub (npm) in versions >= v0.6, <= v0.6 or >= v0.3, <= v0.3 or >= v0.1.2, <= v0.1.2 or >= v0.1.1, <= v0.1.1 or >= v0.1, <= v0.1. This vulnerability has not been exploited in the wild as of the latest reports, but it is under investigation. Users of these versions are advised to take immediate action to mitigate potential risks.
What to do about it
- Upgrade to a version of Covenant that fixes this vulnerability.
- Rotate any JWT tokens that may have been compromised.
- Monitor the primary sources for updates on patched versions and further recommendations.
- Review your application's authentication and authorization mechanisms to ensure they are secure.
- Consider implementing additional security measures to protect sensitive information.
How 0Day would have caught this
covenanthub is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using covenanthub (npm) in versions >= v0.6, <= v0.6 or >= v0.3, <= v0.3 or >= v0.1.2, <= v0.1.2 or >= v0.1.1, <= v0.1.1 or >= v0.1, <= v0.1.
What should I do right now?
Upgrade to a version of Covenant that fixes this vulnerability and rotate any JWT tokens that may have been compromised.
Has this vulnerability been exploited in the wild?
No, this vulnerability has not been exploited in the wild as of the latest reports.
Where can I find more information about this vulnerability?
Consult the primary sources listed in the threat data for more information.