CVE-2026-25598
Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)
Impact
## Summary A security vulnerability has been identified in the Harden-Runner GitHub Action (Community Tier) that allows outbound network connections to evade audit logging. Specifically, outbound traffic using the `sendto`, `sendmsg`, and `sendmmsg` socket system calls can bypass detection and logging when using `egress-policy: audit`. **Note:** This vulnerability only affects audit mode. When using `egress-policy: block`, these connections are properly blocked. It requires the attacker to already have code execution capabilities within the GitHub Actions workflow (e.g., through workflow injection or compromised dependencies) ## Affected Versions - Harden-Runner Community Tier: All versions prior to v2.14.2 - Harden-Runner Enterprise Tier: **NOT AFFECTED** ## Severity **Medium** - This vulnerability affects audit logging capabilities but requires the attacker to already have code execution within the workflow. ## Impact When Harden-Runner is configured in audit mode (`egress-policy: audit`), attackers with the ability to execute arbitrary code in a workflow can: - Send outbound network traffic without generating audit logs - Bypass network monitoring for UDP-based communications **Important:** This vulnerability requires the attacker to already have code execution capabilities within the GitHub Actions workflow (e.g., through workflow injection or compromised dependencies). ## Technical Details The vulnerability stems from incomplete monitoring coverage of certain socket-related system calls. Specifically, the following system calls can be used to send UDP traffic without triggering audit events: - `sendto()` - `sendmsg()` - `sendmmsg()` An attacker with code execution in a workflow can compile and execute native code that uses these system calls to establish covert communication channels. ## Affected Users **This vulnerability ONLY affects users of the Harden-Runner Community Tier.** The Harden-Runner Enterprise Tier is **NOT vulnerable** to this bypass technique. ## Remediation ### For Community Tier Users **Upgrade to Harden-Runner v2.14.2 or later.** This version includes fixes for the logging bypass vulnerability. ### For Enterprise Tier Users No action required. Enterprise tier customers are not affected by this vulnerability. ## Credit We would like to thank [Devansh Batham](https://github.com/devanshbatham) for responsibly disclosing this vulnerability through our security reporting process. Devansh was communicative throughout the process and verified the fix before the fix before it was made public.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| actions | step-security/harden-runner | < 2.14.2 | 2.14.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Stepsecurity | Harden-Runner | before 2.14.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/step-security/harden-runner/releases/tag/v2.14.2
- https://github.com/step-security/harden-runner/security/advisories/GHSA-cpmj-h4f6-r6pq
- https://github.com/advisories/GHSA-cpmj-h4f6-r6pq
- https://github.com/step-security/harden-runner/commit/5ef0c079ce82195b2a36a210272d6b661572d83e
- https://nvd.nist.gov/vuln/detail/CVE-2026-25598