Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability allows attackers to bypass egress-policy: block network restrictions by tunneling exfiltrated data through permitted HTTPS endpoints like dns.google. The attack works by encoding sensitive data (e.g., the runner's hostname) as subdomains in DoH queries, which appear as legitimate HTTPS traffic to Harden-Runner's domain-based filtering but are ultimately forwarded to an attacker-controlled domain. This effectively enables data exfiltration without directly connecting to any blocked destination. Exploitation requires the attacker to already have code execution within the GitHub Actions workflow. The issue was fixed in version 2.16.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-18 | 1 | Patch1 |
| 2026-03-20 | 1 | Disclosure1 |
| 2026-03-24 | 1 | Disclosure1 |
Vulnerabilities I reported to Harden Runner, have now been assigned CVEs and fixed in the latest version. - CVE-2026-32947 - CVE-2026-32946 https://t.co/ZwP2WLZCGl
Post summary
The author reports that the vulnerabilities reported to Harden Runner were assigned CVEs and have been addressed with a fix in the latest release.
CVE-2026-32947 Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability allows a… https://www.cve.org/CVERecord?id=CVE-2026-32947
Post summary
The post briefly announces a DNS over HTTPS (DoH) vulnerability (CVE‑2026‑32947) affecting Harden‑Runner versions 2.15.1 and below, without mentioning exploits, patches, or PoC details.
🟠 Harden-Runner, DNS over HTTPS Vulnerability, #CVE-2026-32947 (Medium) https://dailycve.com/harden-runner-dns-over-https-vulnerability-cve-2026-32947-medium/
Post summary
This post announces the CVE‑2026‑32947 vulnerability in Harden‑Runner related to DNS over HTTPS, rated medium severity, but offers no further details on PoC, exploitation, or patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | stepsecurity | harden-runner | - | - | - |