Auth bypass in Step-Security Harden-Runner
CVE-2026-32947
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability allows attackers to bypass egress-policy: block network restrictions by tunneling exfiltrated data through permitted HTTPS endpoints like dns.google. The attack works by encoding sensitive data (e.g., the runner's hostname) as subdomains in DoH queries, which appear as legitimate HTTPS traffic to Harden-Runner's domain-based filtering but are ultimately forwarded to an attacker-controlled domain. This effectively enables data exfiltration without directly connecting to any blocked destination. Exploitation requires the attacker to already have code execution within the GitHub Actions workflow. The issue was fixed in version 2.16.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (41.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 41.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.002
Affected products
- Step-Security Harden-Runner — versions < 2.16
- Stepsecurity Harden-Runner
Weakness classification (CWE)
References
- github.com/step-security/harden-runner/security/advisories/GHSA-46g3-37rh-v698 (Vendor Advisory)
- github.com/step-security/harden-runner/releases/tag/v2.16.0 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-32947?
- CVE-2026-32947 is a medium-severity vulnerability in Step-Security Harden-Runner, classified under Protection Mechanism Failure. CVSS score: 4.9/10. Published 2026-03-20.
- How severe is CVE-2026-32947?
- Medium severity. CVSS v3 base score is 4.9 out of 10.