GHSA-cpmj-h4f6-r6pq
NoneCVSS
—
EPSS
—
Published
Feb 9, 2026
CISA due date
—
The record
Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| GitHub Actions | step-security/harden-runner | 0 | 2.14.2 |
Related vulnerabilities
- CVE-2026-25598 Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Same vulnerability
- CVE-2026-87535 Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to… CWE-221
- CVE-2020-37268 Print Assumptions does not report that a definition was produced while universe checking… CWE-778
- GHSA-gfp8-mp24-5vxg @hulumi/baseline: CloudTrail selector tampering events were not fully detected CWE-778
- CVE-2026-32803 Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0… CWE-778
- CVE-2026-32693 In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is… CWE-778
- CVE-2025-52644 HCL AION is affected by a vulnerability where certain user actions are not adequately… CWE-778
- CVE-2025-66552 Nextcloud Server admin_audit does not log all actions on files in groupfolders CWE-778