VulnerabilityAnalyzed

CVE-2026-25598

Prior to 2.14.2, a security vulnerability has been identified in the Harden-Runner GitHub Action (Community Tier) that allows outbound network connections to evade audit logging.

MEDIUM 6.3EPSS 0.32%

Does this matter?

Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.

Description

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the Harden-Runner GitHub Action (Community Tier) that allows outbound network connections to evade audit logging. Specifically, outbound traffic using the sendto, sendmsg, and sendmmsg socket system calls can bypass detection and logging when using egress-policy: audit. This vulnerability is fixed in 2.14.2.

CVSS 4.0: 6.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.32% probability · 25th percentile
CISA KEV: Not listed
Weakness: CWE-778
Affected: stepsecurity/harden-runner
Source: security-advisories@github.com

References

https://github.com/step-security/harden-runner/releases/tag/v2.14.2Release Notes
https://github.com/step-security/harden-runner/security/advisories/GHSA-cpmj-h4f6-r6pqVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.