Advisories · Technology

step-security harden-runner.

Every CVE that names step-security harden-runner among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-32947 CVE record

CVSS 4.6 Medium

Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)
- step-security harden-runner
- Broken access control
- CWE-693
Not analysed yet 20 Mar 2026
CVE-2026-32946 CVE record

CVSS 4.6 Medium

Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)
- step-security harden-runner
- Broken access control
- CWE-693
Not analysed yet 20 Mar 2026
CVE-2026-25598 CVE record

CVSS 6.3 Medium

Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)
- step-security harden-runner
- CWE-778
Not analysed yet 9 Feb 2026
CVE-2025-32955 CVE record

CVSS 6.0 Medium

Harden-Runner Evasion of 'disable-sudo' policy
- step-security harden-runner
- Privilege escalation
Not analysed yet 21 Apr 2025
CVE-2024-52587 CVE record

CVSS 2.7 Low

Harden-Runner has command injection weaknesses in `setup.ts` and `arc-runner.ts`
- step-security harden-runner
- Command injection
Not analysed yet 18 Nov 2024