The red team's own toolkit has a hole in it: critical bug found in Covenant C2 framework

A newly disclosed vulnerability, tracked as CVE-2026-92717 and rated critical with a CVSS score of 9.1, has been found in Covenant, an open-source “.NET command and control” (C2) framework built for red teamers - the security professionals paid to simulate attacks against their own employers or clients. The bug means someone with no login credentials at all can potentially get hold of a working authentication token from a Covenant server.

What the bug actually does

Covenant runs a web-based control panel that lets several operators share access to a single C2 deployment during a security engagement, using a real-time messaging component called a SignalR hub. According to the NVD listing, that hub - CovenantHub - was registered without an Authorize attribute in versions through 0.6. In plain terms, the code that is supposed to check “is this person logged in?” was never applied to it.

That gap lets an unauthenticated caller invoke a function called CreateHttpListener and, in doing so, receive back a signed JWT - a cryptographic token normally issued only to users who have already proven who they are. Once you have a valid token, you look legitimate to the rest of the application. The NVD summary text is cut short before it fully spells out what an attacker does with that token next, so the precise blast radius beyond “obtaining valid credentials” isn’t confirmed in the public record yet.

Covenant itself is a real, actively maintained project - it sits on GitHub with roughly 4,700 stars and 823 forks - built specifically to demonstrate .NET attack techniques for authorised testing.

So who is actually at risk

This is not a bug in a browser, a phone or an app the average reader has installed. Covenant is specialist software: it’s typically stood up by penetration testers and red-team operators on infrastructure they control, often only reachable inside a private network or a locked-down cloud instance during an engagement.

That narrows the exposure considerably. The people who need to care are organisations or individuals running a live Covenant deployment - particularly if its web interface is reachable from an untrusted network. If an attacker can reach that interface, this flaw would let them skip the login screen entirely and start pulling privileges normally reserved for authenticated operators, which for a C2 tool is about as bad as it gets given the tool’s purpose is command and control over other machines.

Three things remain genuinely unclear from what’s been published so far: whether a patched version exists, whether anyone is actively exploiting this in the wild, and how many Covenant instances are even running publicly reachable. None of that has been confirmed in the disclosure, so treat any claim of imminent mass exploitation with caution until there’s evidence for it.

What to do about it

If you or your organisation runs Covenant, the sensible move is to check the version against future patch notes from the project, restrict network access to the web interface to trusted hosts only, and rotate any credentials or tokens if there’s any chance the server has been internet-facing. For everyone else - this simply isn’t software that touches ordinary devices or accounts.

The takeaway

This is a serious flaw for a small, specific audience: people running their own red-team infrastructure. It’s a useful reminder that even tools built by security specialists, for security specialists, can ship the exact class of bug they’re designed to help find in other people’s software.