step-security harden-runner vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20251
3. 20263

Newest CVEs

• CVE-2026-32947

  Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)

  step-security · harden-runner

  Medium4.6
• CVE-2026-32946

  Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)

  step-security · harden-runner

  Medium4.6
• CVE-2026-25598

  Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)

  step-security · harden-runner

  Medium6.3
• CVE-2025-32955

  Harden-Runner Evasion of 'disable-sudo' policy

  step-security · harden-runner

  Medium6.0
• CVE-2024-52587

  Harden-Runner has command injection weaknesses in `setup.ts` and `arc-runner.ts`

  step-security · harden-runner

  Low2.7