PT-2026-25988 · Unknown · Harden-Runner

Devanshbatham · Published 2026-03-17 · Updated 2026-03-24 · CVE-2026-32947

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Harden-Runner versions 2.15.1 and below

Description Harden-Runner, a CI/CD security agent functioning as an EDR for GitHub Actions runners, contains a DNS over HTTPS (DoH) issue. This allows attackers to circumvent network restrictions imposed by the egress-policy: block setting by tunneling exfiltrated data through permitted HTTPS endpoints, such as dns.google. The attack involves encoding sensitive data, like the runner's hostname, as subdomains within DoH queries. These queries appear as legitimate HTTPS traffic to Harden-Runner’s domain-based filtering but are ultimately forwarded to a domain controlled by the attacker, enabling data exfiltration without directly connecting to blocked destinations. Exploitation requires pre-existing code execution within the GitHub Actions workflow. The Enterprise Tier of Harden-Runner is not affected.

Recommendations Upgrade to Harden-Runner version 2.16.0 or later.

Exploit

Fix

Protection Mechanism Failure

Incorrect Authorization

Weakness Enumeration

CWE-693

CWE-863

Related Identifiers

CVE-2026-32947

GHSA-46G3-37RH-V698

Affected Products

Harden-Runner

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32947.json · Exploit
• https://github.com/step-security/harden-runner/security/advisories/GHSA-46g3-37rh-v698 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32947 · Security Note
• https://osv.dev/vulnerability/GHSA-46g3-37rh-v698 · Vendor Advisory
• https://github.com/step-security/harden-runner · Note
• https://github.com/step-security/harden-runner/releases/tag/v2.16.0 · Note
• https://reddit.com/r/VulnMatter/comments/1rx6vrw/resumen_diario_de_vulnerabilidades_18032026 · Reddit Post
• https://twitter.com/CVEnew/status/2034891564627956101 · Twitter Post
• https://twitter.com/0xAsm0d3us/status/2034268851844821295 · Twitter Post
• https://twitter.com/dailycve/status/2036431195412615388 · Twitter Post