CVE-2026-25598
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Feb 9, 2026
CISA due date
—
The record
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the Harden-Runner GitHub Action (Community Tier) that allows outbound network connections to evade audit logging. Specifically, outbound traffic using the sendto, sendmsg, and sendmmsg socket system calls can bypass detection and logging when using egress-policy: audit. This vulnerability is fixed in 2.14.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| GitHub Actions | step-security/harden-runner | 0 | 2.14.2 |
Related vulnerabilities
- GHSA-cpmj-h4f6-r6pq Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and… Same vulnerability
- CVE-2020-37268 Print Assumptions does not report that a definition was produced while universe checking… CWE-778
- GHSA-gfp8-mp24-5vxg @hulumi/baseline: CloudTrail selector tampering events were not fully detected CWE-778
- CVE-2026-32803 Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0… CWE-778
- CVE-2026-32693 In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is… CWE-778
- CVE-2025-52644 HCL AION is affected by a vulnerability where certain user actions are not adequately… CWE-778
- CVE-2025-66552 Nextcloud Server admin_audit does not log all actions on files in groupfolders CWE-778