CVE-2026-32947

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability allows attackers to bypass egress-policy: block network restrictions by tunneling exfiltrated data through permitted HTTPS endpoints like dns.google. The attack works by encoding sensitive data (e.g., the runner's hostname) as subdomains in DoH queries, which appear as legitimate HTTPS traffic to Harden-Runner's domain-based filtering but are ultimately forwarded to an attacker-controlled domain. This effectively enables data exfiltration without directly connecting to any blocked destination. Exploitation requires the attacker to already have code execution within the GitHub Actions workflow. The issue was fixed in version 2.16.0.

• CWE-693
• CWE-863

• https://github.com/step-security/harden-runner/releases/tag/v2.16.0Product, Release Notes
• https://github.com/step-security/harden-runner/security/advisories/GHSA-46g3-37rh-v698Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32941Sliver is a command and control framework that uses a custom…6.5
• CVE-2026-32942PJSIP is a free and open source multimedia communication lib…8.1
• CVE-2026-32943Parse Server is an open source backend that can be deployed …3.1
• CVE-2026-32944Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-32945PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2026-32946Harden-Runner is a CI/CD security agent that works like an E…2.7
• CVE-2026-32948sbt is a build tool for Scala, Java, and others. From versio…7.8
• CVE-2026-32949SQLBot is an intelligent data query system based on a large …7.5
• CVE-2026-32950SQLBot is an intelligent data query system based on a large …8.8
• CVE-2026-32951Discourse is an open-source discussion platform. From versio…4.3
• CVE-2026-32952go-ntlmssp is a Go package that provides NTLM/Negotiate auth…7.5
• CVE-2026-32953Tillitis TKey Client package is a Go package for a TKey clie…4.6