CI/CD Security Agent Vulnerability in Harden-Runner by Step Security

CVE-2026-32946

What is CVE-2026-32946?

The Harden-Runner, a CI/CD security agent, suffers from a vulnerability that allows attackers to bypass egress policies using DNS queries over TCP. This issue affects versions 2.15.1 and below, where outbound network connections are not adequately filtered, allowing unauthorized traffic through. The vulnerability necessitates that an attacker already possesses code execution capabilities within a GitHub Actions workflow. This oversight can be exploited using tools like 'dig' to initiate TCP-based DNS queries, potentially leading to unauthorized data exfiltration. The issue has been rectified in version 2.16.0, which addresses this security flaw.

References