PT-2026-25987 · Unknown · Harden-Runner

Devanshbatham · Published 2026-03-17 · Updated 2026-03-20 · CVE-2026-32946

Positive Technologies (AI Summary)

CVSS v4.0

4.6

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Harden-Runner versions 2.15.1 and below

Description Harden-Runner, a CI/CD security agent functioning as an EDR for GitHub Actions runners, has an issue where the egress-policy: block network restriction can be bypassed using DNS queries over TCP. When egress-policy: block is enabled with a restrictive allowed-endpoints list, non-compliant traffic should be denied. However, DNS queries over TCP are not adequately restricted, allowing tools like dig to initiate TCP-based DNS queries without being blocked. This requires an attacker to already have code execution capabilities within the GitHub Actions workflow. The Enterprise Tier of Harden-Runner is not affected.

Recommendations Upgrade to Harden-Runner version 2.16.0 or later.

Exploit

Fix

Protection Mechanism Failure

Incorrect Authorization

Weakness Enumeration

CWE-693

CWE-863

Related Identifiers

CVE-2026-32946

GHSA-G699-3X6G-WM3G

Affected Products

Harden-Runner

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32946.json · Exploit
• https://github.com/step-security/harden-runner/security/advisories/GHSA-g699-3x6g-wm3g · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g699-3x6g-wm3g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32946 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32946 · Vendor Advisory
• https://github.com/step-security/harden-runner · Note
• https://github.com/step-security/harden-runner/releases/tag/v2.16.0 · Note
• https://twitter.com/CVEnew/status/2034891566507020496 · Twitter Post
• https://twitter.com/cyberbivash/status/2034862588916355089 · Twitter Post
• https://twitter.com/0xAsm0d3us/status/2034268851844821295 · Twitter Post