CVE-2026-32946

Katalog CVE

CVSS 2.7 · Low EPSS 0,39%

Kerentanan Protection Mechanism Failure pada stepsecurity harden-runner. Skor CVSS 3.1 2.7 (Low) menurut NVD.

Deskripsi (NVD)

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, the Harden-Runner that allows bypass of the egress-policy: block network restriction using DNS queries over TCP. Egress policies are enforced on GitHub runners by filtering outbound connections at the network layer. When egress-policy: block is enabled with a restrictive allowed-endpoints list (e.g., only github.com:443), all non-compliant traffic should be denied. However, DNS queries over TCP, commonly used for large responses or fallback from UDP, are not adequately restricted. Tools like dig can explicitly initiate TCP-based DNS queries (+tcp flag) without being blocked. This vulnerability requires the attacker to already have code execution capabilities within the GitHub Actions workflow. The issue has been fixed in version 2.16.0.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-693: Protection Mechanism Failure
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/step-security/harden-runner/security/advisories/GHSA-g699-3x6g-wm3g advisory vendor
• https://github.com/step-security/harden-runner/releases/tag/v2.16.0 product · release notes