Executive brief
Covenant is a .NET command and control (C2) framework used by red teamers to manage offensive operations across multiple systems. The CovenantHub SignalR endpoint lacks authentication protection, allowing an attacker to invoke the CreateHttpListener method without credentials, obtain a signed JWT token, and then use that token to access the entire operator API—including sensitive data such as compromised credentials, malware binaries, operational events, and the list of operators. This grants an unauthenticated attacker complete control over the C2 infrastructure.
Technical details
The vulnerability is an authentication bypass in the CovenantHub SignalR hub, which is registered without an [Authorize] attribute in the ASP.NET Core application. An attacker can invoke the CreateHttpListener method over the unauthenticated SignalR connection to receive a valid, signed JWT token. With this token, the attacker can authenticate to the operator API and call any method with full privileges, including access to grunts (compromised hosts), stored credentials, compiled binaries, operational events, and the roster of authorized operators. The vulnerability affects Covenant through version 0.6 and requires only network access to the CovenantHub endpoint; no prior authentication or user interaction is needed.
Affected products
- Covenant Covenant through 0.6
Timeline
- 2026-09-16: disclosed