PT-2026-6908 · Unknown · Harden-Runner

Devanshbatham · Published 2026-02-07 · Updated 2026-02-28 · CVE-2026-25598

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Harden-Runner versions prior to 2.14.2

Description Harden-Runner is a CI/CD security agent designed to function like an EDR for GitHub Actions runners. A security issue has been identified in the Community Tier of Harden-Runner that allows outbound network connections to bypass audit logging. Specifically, outbound traffic utilizing the sendto, sendmsg, and sendmmsg socket system calls can evade detection and logging when the egress-policy is set to 'audit'. This bypass requires an attacker to already have code execution capabilities within the GitHub Actions workflow. The issue does not affect the Enterprise Tier. The vulnerability stems from incomplete monitoring coverage of certain socket-related system calls, allowing attackers to establish covert communication channels using UDP traffic without generating audit events.

Recommendations Upgrade to Harden-Runner version 2.14.2 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-778

CWE-221

CWE-863

Related Identifiers

CVE-2026-25598

GHSA-CPMJ-H4F6-R6PQ

Affected Products

Harden-Runner

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25598.json · Exploit
• https://github.com/step-security/harden-runner/security/advisories/GHSA-cpmj-h4f6-r6pq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25598 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cpmj-h4f6-r6pq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25598 · Security Note
• https://github.com/step-security/harden-runner · Note
• https://github.com/step-security/harden-runner/releases/tag/v2.14.2 · Note
• https://github.com/step-security/harden-runner/commit/5ef0c079ce82195b2a36a210272d6b661572d83e · Note
• https://t.me/cveNotify/153605 · Telegram Post
• https://twitter.com/0xAsm0d3us/status/2021579215708033438 · Twitter Post
• https://twitter.com/0xAsm0d3us/status/2020026359184236710 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2021592173062373583 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2020968546377880031 · Twitter Post
• https://twitter.com/0xAsm0d3us/status/2021578640887087361 · Twitter Post
• https://twitter.com/CVEnew/status/2020959698166354100 · Twitter Post