Bypass Vulnerability in Harden-Runner CI/CD Security Agent from Step Security

CVE-2025-32955

What is CVE-2025-32955?

Harden-Runner, a CI/CD security agent designed to protect GitHub Actions runners, is vulnerable to a disable-sudo bypass attack. This vulnerability arises from the way the agent manages sudo permissions, where the runner user, despite being removed from the sudoers file, retains group membership in the Docker group. As a result, this user can manipulate the Docker daemon to launch privileged containers or access the host filesystem undetected. This capability allows an attacker to bypass the intended restrictions, potentially regaining root access. The issue has been addressed in version 2.12.0, which implements the necessary patches to prevent such exploits.

References