Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the Harden-Runner GitHub Action (Community Tier) that allows outbound network connections to evade audit logging. Specifically, outbound traffic using the sendto, sendmsg, and sendmmsg socket system calls can bypass detection and logging when using egress-policy: audit. This vulnerability is fixed in 2.14.2.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-07 | 1 | Patch1 |
| 2026-02-09 | 3 | Disclosure2General1 |
| 2026-02-11 | 2 | Exploit1General1 |
New Write-up! [CVE-2026-25598] Bypassing Outbound Connections Detection in harden-runner https://devansh.bearblog.dev/harden-runner/ https://t.co/2JAon9wi8f
Post summary
The tweet links to a write‑up on CVE‑2026‑25598 but provides no concrete details about the vulnerability, PoC, exploit code, patches, or active exploitation.
Recently reported an issue related to evasion of logging of outbound networks connections in harden-runner GitHub action using connectionless UDP syscalls (sendto, sendmsg, and sendmmg), this is now fixed and disclosed. CVE-2026-25598 https://github.com/step-security/harden-runner/security/advisories/GHSA-cpmj-h4f6-r6pq https://t.co/k7ZxpdNffj
Post summary
A recently disclosed vulnerability (CVE-2026-25598) in the harden-runner GitHub action that bypasses logging of outbound UDP connections has been fixed and patched.
CVE-2026-25598 Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the Harden… https://www.cve.org/CVERecord?id=CVE-2026-25598
Post summary
The text announces the existence of CVE-2026-25598 in Harden-Runner before version 2.14.2, but provides no further technical details or mitigation information.
🚨 #CVE-2026-25598 Exposed: How Attackers Bypass Outbound Connection Detection in #GitHub’s Harden-Runner – Full Exploit Guide https://undercodetesting.com/cve-2026-25598-exposed-how-attackers-bypass-outbound-connection-detection-in-githubs-harden-runner-full-exploit-guide/ Educational Purposes!
Post summary
The post announces a detailed exploit guide for CVE‑2026‑25598, outlining how attackers bypass outbound connection detection in GitHub’s Harden‑Runner, but does not mention active attacks or available patches.
CVE-2026-25598 Audit Bypass in Harden-Runner GitHub Action Community Tier via Socket System Calls https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25598
Post summary
The text announces CVE-2026-25598, an audit bypass vulnerability in Harden-Runner GitHub Action involving socket system calls, without providing a PoC, exploit, or patch details.
CVE-2026-25598: The Invisible Courier: Bypassing Harden-Runner's Watchful Eye via Syscall Ninja Tactics In the world of CI/CD security, visibility is everything. Step Security's Harden-Runner promises to be the all-seeing eye for GitHub Actions, monit... https://cvereports.com/reports/CVE-2026-25598
Post summary
The excerpt announces a CVE with a headline but offers no substantive details, proof‑of‑concept, exploit information, or patch guidance.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | stepsecurity | harden-runner | - | - | - |