What’s Vulnerable › Products

step-security harden-runner vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your step-security harden-runner version is affected

Latest step-security harden-runner vulnerabilities

• CVE-2026-32947 — Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier) (CVSS 4.9)
• CVE-2026-32946 — Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier) (CVSS 2.7)
• CVE-2026-25598 — Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier) (CVSS 5.3)
• CVE-2025-32955 — Harden-Runner Evasion of 'disable-sudo' policy (CVSS 6.0)