Step-Security

5 CVEs across 1 Step-Security products. Browse Step-Security vulnerabilities, severities, and proof-of-concept exploits.

Step-Security products with known CVEs

ProductCVEs
Harden-Runner5
Step-Security CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-32947Medium4.92026-03-20Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability a…
CVE-2026-32946Low2.72026-03-20Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, the Harden-Runner that allows bypass o…
CVE-2026-25598Medium5.32026-02-09Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the…
CVE-2025-32955Medium6.02025-04-21Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to `disable-sud…
CVE-2024-52587High8.82024-11-18StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden…