CVE-2026-25598: Harden-Runner Audit Bypass Vulnerability

CVE-2026-25598 Overview

CVE-2026-25598 is a security vulnerability identified in the Harden-Runner GitHub Action (Community Tier), a CI/CD security agent that functions as an endpoint detection and response (EDR) solution for GitHub Actions runners. The vulnerability allows outbound network connections to evade audit logging, undermining the security monitoring capabilities of the action.

Specifically, outbound traffic using the sendto, sendmsg, and sendmmsg socket system calls can bypass detection and logging when the action is configured with egress-policy: audit. This means malicious processes or compromised dependencies within a GitHub Actions workflow could exfiltrate data or communicate with external command-and-control servers without being recorded in the audit logs.

Critical Impact

Attackers can establish covert outbound network connections from GitHub Actions runners that completely evade security audit logging, potentially enabling undetected data exfiltration or supply chain attacks.

Affected Products

• Harden-Runner GitHub Action (Community Tier) versions prior to 2.14.2

Discovery Timeline

• February 9, 2026 - CVE-2026-25598 published to NVD
• February 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25598

Vulnerability Analysis

This vulnerability stems from insufficient logging coverage (CWE-778) within the Harden-Runner GitHub Action's network monitoring subsystem. The action is designed to monitor and audit egress network traffic from GitHub Actions runners to detect potentially malicious outbound connections during CI/CD pipeline execution.

The core issue is that the monitoring mechanism fails to intercept outbound network traffic initiated through specific socket system calls. While the action successfully monitors standard send() operations, it does not properly hook or log traffic sent via the sendto(), sendmsg(), and sendmmsg() system calls. These are alternative methods for transmitting data over network sockets that provide additional functionality like specifying destination addresses at send time.

Root Cause

The root cause is an incomplete implementation of network syscall monitoring in the Harden-Runner agent. When implementing egress traffic auditing, the developers hooked the standard socket send operations but overlooked the alternative datagram-oriented send functions. The sendto(), sendmsg(), and sendmmsg() syscalls are commonly used for UDP communications and can also be used with TCP sockets, providing attackers with a reliable bypass technique.

This represents a classic case of insufficient logging where security-critical events (network egress) are not being captured comprehensively, allowing attackers to operate below the visibility threshold of the security tooling.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who has compromised a dependency or injected malicious code into a GitHub Actions workflow can exploit this vulnerability to:

1. Establish outbound connections to attacker-controlled infrastructure without triggering audit alerts
2. Exfiltrate sensitive data such as secrets, tokens, or source code from the CI/CD environment
3. Download additional malicious payloads or receive command-and-control instructions
4. Conduct supply chain attacks while evading the security monitoring that organizations rely on

A malicious actor would simply need to use the sendto(), sendmsg(), or sendmmsg() system calls instead of standard socket send operations to communicate with external servers. These syscalls are readily available in most programming languages and system libraries.

The vulnerability does not require special privileges and can be exploited by any code running within the GitHub Actions runner environment. For detailed technical information, refer to the GitHub Security Advisory GHSA-cpmj-h4f6-r6pq.

Detection Methods for CVE-2026-25598

Indicators of Compromise

• Unexpected outbound network connections from GitHub Actions runners that do not appear in Harden-Runner audit logs
• Discrepancies between network flow data and Harden-Runner logged egress events
• Processes using UDP sockets or raw socket operations during workflow execution
• Evidence of data exfiltration or command-and-control communication in network monitoring systems outside of Harden-Runner

Detection Strategies

• Compare Harden-Runner audit logs against independent network monitoring to identify gaps in logging coverage
• Monitor for use of sendto(), sendmsg(), and sendmmsg() syscalls in workflow processes using external eBPF-based monitoring tools
• Review GitHub Actions workflow logs for suspicious dependencies or unexpected script execution
• Implement network-level egress controls and logging independent of Harden-Runner to establish a secondary detection layer

Monitoring Recommendations

• Deploy network-level firewall rules and logging for GitHub Actions runner infrastructure to capture traffic that may bypass application-level auditing
• Enable comprehensive audit logging at the infrastructure level for all outbound connections from CI/CD environments
• Establish baselines for expected egress traffic patterns and alert on anomalies
• Regularly verify that security tooling is capturing all expected network events through periodic testing

How to Mitigate CVE-2026-25598

Immediate Actions Required

• Upgrade Harden-Runner GitHub Action to version 2.14.2 or later immediately
• Audit existing workflow runs for any suspicious unlogged network activity that may have occurred before patching
• Review and validate that egress monitoring is functioning correctly after the upgrade
• Consider implementing network-level egress controls as an additional defense layer while validating the fix

Patch Information

The vulnerability has been fixed in Harden-Runner version 2.14.2. Organizations should update their GitHub Actions workflows to reference the patched version. The fix ensures that outbound traffic using sendto(), sendmsg(), and sendmmsg() socket system calls is properly detected and logged when using egress-policy: audit.

For patch details, see the GitHub Release v2.14.2.

Workarounds

• Implement network-level egress filtering using firewall rules to restrict outbound connections from GitHub Actions runners to known-good destinations
• Deploy additional network monitoring solutions that operate independently of Harden-Runner to ensure comprehensive visibility
• Consider using egress-policy: block instead of egress-policy: audit to prevent unauthorized outbound connections entirely, though this may require additional configuration for legitimate traffic
• Isolate CI/CD runner environments in network segments with strict egress controls

# Update Harden-Runner in your GitHub Actions workflow
# Replace the uses directive in your workflow YAML:
# Before: uses: step-security/harden-runner@v2.14.1
# After:
uses: step-security/harden-runner@v2.14.2