PT-2025-17463 · Docker+1 · Docker+1
Darryk10
+1
·
Published
2025-04-21
·
Updated
2025-04-28
·
CVE-2025-32955
CVSS v2.0
6.2
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Harden-Runner versions 0.12.0 through 2.12.0
Description
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. The
disable-sudo policy option is intended to prevent the GitHub Actions runner user from using sudo by removing the runner user from the sudoers file. However, this control can be bypassed as the runner user, being part of the docker group, can interact with the Docker daemon to launch privileged containers or access the host filesystem, allowing the attacker to regain root access or restore the sudoers file, effectively bypassing the restriction.Recommendations
Update to version 2.12.0 or later to patch the
disable-sudo bypass vulnerability.
As a temporary workaround, consider restricting the runner user's access to the Docker daemon to minimize the risk of exploitation.
Avoid using the disable-sudo policy option until the issue is resolved.Exploit
Fix
LPE
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Docker
Harden-Runner