Security
فارسی
All products

step-security/harden-runner

GitHub Actions · Package
5 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)CVE-2026-32947 · GHSA-46G3-37RH-V698 step-security/harden-runnerExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 GitHub ActionsRed Hat Medium Fix reported
Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)CVE-2026-32946 · GHSA-G699-3X6G-WM3G step-security/harden-runnerExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 GitHub ActionsRed Hat Medium Fix reported
Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)CVE-2026-25598 · GHSA-CPMJ-H4F6-R6PQ step-security/harden-runnerExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 GitHub ActionsRed Hat Medium Fix reported
Harden-Runner allows evasion of 'disable-sudo' policyCVE-2025-32955 · GHSA-MXR3-8WHJ-J74R step-security/harden-runnerRed Hat Enterprise Linux AI (RHEL AI)/rhelai1/pathservice-rhel9 GitHub ActionsRed Hat Medium Fix reported
Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`CVE-2024-52587 · GHSA-G85V-WF27-67XC step-security/harden-runnerRed Hat Trusted Artifact Signer/rhtas/ec-rhel9 GitHub ActionsRed Hat Low Fix reported