Vulnerabilities

TI-2026-25395 CVE-2026-32947 · GHSA-46g3-37rh-v698

Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)

LOW 21

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners.

CVSS 4.0MEDIUM 4.6 Network High privileges No interaction EPSS 0.00317 Published 2026-03-20 Partial fix · 2.16, 2.16.0 CWE-693

TI-2026-25394 CVE-2026-32946 · GHSA-g699-3x6g-wm3g

LOW 21

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners.

CVSS 4.0MEDIUM 4.6 Network High privileges No interaction EPSS 0.00263 Published 2026-03-20 Partial fix · 2.16.0 CWE-693

TI-2026-20705 CVE-2026-25598 · GHSA-cpmj-h4f6-r6pq

LOW 28

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0034 Published 2026-02-09 Partial fix · 2.14.2 CWE-778

TI-2025-23965 CVE-2025-32955 · GHSA-mxr3-8whj-j74r

LOW 26

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners.

CVSS 3.1MEDIUM 6.0 Local High privileges No interaction EPSS 0.00226 Published 2025-04-21 Partial fix · 2.12.0 CWE-268

TI-2024-35247 CVE-2024-52587 · GHSA-g85v-wf27-67xc

LOW 21

StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.02761 Published 2024-11-18 Partial fix · 2.10.2 CWE-78