Vulnerability · Published Feb 9, 2026 · Assigned by GitHub_M

CVE-2026-25598Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)

Medium 6.3

In plain English

A medium-severity security flaw in harden-runner from step-security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.3%top 72.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the Harden-Runner GitHub Action (Community Tier) that allows outbound network connections to evade audit logging. Specifically, outbound traffic using the sendto, sendmsg, and sendmmsg socket system calls can bypass detection and logging when using egress-policy: audit. This vulnerability is fixed in 2.14.2.

Affected products (as reported)

Vendor	Product	Versions
step-security	harden-runner	< 2.14.2

Weakness: CWE-778 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/step-security/harden-runner/security/advisories/GHSA-cpmj-h4f6-r6pq x_refsource_CONFIRM
https://github.com/step-security/harden-runner/releases/tag/v2.14.2 x_refsource_MISC