CVE-2026-32947: Harden-Runner Auth Bypass Vulnerability

CVE-2026-32947 Overview

CVE-2026-32947 is a DNS over HTTPS (DoH) bypass vulnerability affecting StepSecurity Harden-Runner, a CI/CD security agent designed to function as an EDR for GitHub Actions runners. The vulnerability allows attackers to circumvent egress-policy: block network restrictions by tunneling exfiltrated data through permitted HTTPS endpoints such as dns.google. This bypass technique enables sensitive data exfiltration without directly connecting to blocked destinations, undermining the core security controls that Harden-Runner is designed to enforce.

Critical Impact
Attackers with code execution within GitHub Actions workflows can bypass network egress restrictions and exfiltrate sensitive data including runner hostnames and potentially secrets through DNS over HTTPS tunneling.

Affected Products

StepSecurity Harden-Runner versions 2.15.1 and below (Community Edition)

Discovery Timeline

2026-03-20 - CVE CVE-2026-32947 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-32947

Vulnerability Analysis

This vulnerability represents a Protection Mechanism Failure (CWE-693) in Harden-Runner's network egress filtering implementation. The attack exploits a gap between how Harden-Runner enforces domain-based filtering and how DNS over HTTPS protocols operate. When egress-policy: block is configured, Harden-Runner monitors and restricts outbound network connections to prevent unauthorized data exfiltration. However, the filtering mechanism trusts HTTPS connections to known legitimate DNS services like dns.google.

An attacker who has already achieved code execution within a GitHub Actions workflow can abuse this trust relationship. By encoding sensitive data (such as runner hostnames, environment variables, or secrets) as subdomains in DoH queries, the malicious payload appears as legitimate HTTPS traffic to Harden-Runner's domain-based filtering. The DoH resolver then forwards these queries containing encoded exfiltration data to an attacker-controlled domain, effectively creating a covert channel that bypasses all egress restrictions.

Root Cause

The root cause lies in Harden-Runner's reliance on domain-based filtering without inspecting the content or nature of DNS-over-HTTPS queries. The security architecture assumes that permitting connections to trusted DNS providers like dns.google is safe, not accounting for the fact that DoH queries can encapsulate arbitrary subdomain data that ultimately resolves through external authoritative nameservers controlled by attackers. This creates a classic covert channel vulnerability where permitted traffic serves as a carrier for prohibited data flows.

Attack Vector

The attack requires the attacker to first gain code execution within a GitHub Actions workflow. This could occur through compromised dependencies, malicious pull requests, or supply chain attacks targeting the CI/CD pipeline. Once code execution is achieved, the attacker constructs DoH queries where sensitive data is encoded into the subdomain portion of the query. For example, encoding the runner's hostname or extracted secrets as Base64 or hex-encoded subdomain labels, then sending these as DoH queries to permitted endpoints like dns.google. The queries are then recursively resolved, reaching the attacker's authoritative DNS server where the exfiltrated data can be decoded and collected.

The vulnerability is particularly concerning in CI/CD environments where secrets, API tokens, and deployment credentials may be accessible during workflow execution. The network-based attack vector combined with the requirement for prior code execution results in a constrained but impactful threat scenario.

Detection Methods for CVE-2026-32947

Indicators of Compromise

Unusual volumes of HTTPS requests to DNS-over-HTTPS providers (dns.google, cloudflare-dns.com, doh.opendns.com) from GitHub Actions runners
DNS queries containing abnormally long or encoded subdomain strings that may indicate data exfiltration attempts
Workflow logs showing unexpected network activity to DoH endpoints during job execution
Resolution requests for domains with suspicious patterns (Base64-encoded strings, hex sequences) in subdomain labels

Detection Strategies

Monitor workflow execution logs for unexpected DoH query patterns or unusual network behavior
Implement network traffic analysis to identify high-frequency requests to DNS-over-HTTPS endpoints
Review GitHub Actions workflow configurations for signs of compromised or malicious code injection
Correlate DNS query logs from organizational resolvers with Actions runner activity timestamps

Monitoring Recommendations

Enable detailed network egress logging in Harden-Runner to capture DoH endpoint access patterns
Configure alerting for workflows that make excessive requests to known DoH providers
Establish baseline network behavior for GitHub Actions runners to identify anomalous exfiltration attempts
Integrate CI/CD pipeline monitoring with SIEM solutions for centralized visibility

How to Mitigate CVE-2026-32947

Immediate Actions Required

Upgrade StepSecurity Harden-Runner to version 2.16.0 or later immediately
Review recent GitHub Actions workflow logs for any suspicious DoH query activity
Audit workflows for signs of unauthorized code modifications or compromised dependencies
Rotate any secrets that may have been exposed during the vulnerable period

Patch Information

StepSecurity has addressed this vulnerability in Harden-Runner version 2.16.0. The fix implements additional controls to prevent DNS-over-HTTPS tunneling bypasses of the egress policy. Users should update their workflow configurations to reference the patched version. For detailed patch information, see the Harden-Runner v2.16.0 Release and the GitHub Security Advisory GHSA-46g3-37rh-v698.

Workarounds

Block or limit access to DNS-over-HTTPS providers at the network level if immediate patching is not possible
Implement additional network monitoring to detect DoH-based exfiltration attempts
Review and restrict workflow permissions to minimize the impact of potential code execution compromises
Consider temporarily disabling untrusted workflows until the upgrade is completed

bash

# Update Harden-Runner in GitHub Actions workflow
# Replace uses: step-security/harden-runner@v2.15.1 with:
uses: step-security/harden-runner@v2.16.0