CVE-2026-32946 Details
Description
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, the Harden-Runner that allows bypass of the egress-policy: block network restriction using DNS queries over TCP. Egress policies are enforced on GitHub runners by filtering outbound connections at the network layer. When egress-policy: block is enabled with a restrictive allowed-endpoints list (e.g., only github.com:443), all non-compliant traffic should be denied. However, DNS queries over TCP, commonly used for large responses or fallback from UDP, are not adequately restricted. Tools like dig can explicitly initiate TCP-based DNS queries (+tcp flag) without being blocked. This vulnerability requires the attacker to already have code execution capabilities within the GitHub Actions workflow. The issue has been fixed in version 2.16.0.
A vulnerability exists in Harden-Runner versions 2.15.1 and below, specifically in the Community Tier, allowing users to bypass network restrictions imposed by the egress-policy: block. This is achieved by sending DNS queries over TCP to external resolvers, evading configured network controls. The vulnerability arises because outbound DNS traffic over TCP is not properly restricted, enabling data exfiltration even with a strict allowed-endpoints list. This issue requires existing code execution capabilities within a GitHub Actions workflow to exploit.
Users of the Community Tier should upgrade to Harden-Runner version 2.16.0 or later. Enterprise Tier users are not affected by this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/step-security/harden-runner/releases/tag/v2.16.0 | [email protected] | ProductRelease Notes |
| https://github.com/step-security/harden-runner/security/advisories/GHSA-g699-3x6g-wm3g | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| stepsecurity harden-runner | < 2.16.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |