CVE-2026-32947

🎯 CVE-2026-32947 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-32947 | Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability allows attackers to bypass egress-policy: block network restrictions by tunneling exfiltrated data through permitted HTTPS endpoints like dns.google. The attack works by encoding sensitive data (e.g., the runner's hostname) as subdomains in DoH queries, which appear as legitimate HTTPS traffic to Harden-

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability allows attackers to bypass egress-policy: block network restrictions by tunneling exfiltrated data through permitted HTTPS endpoints like dns.google. The attack works by encoding sensitive data (e.g., the runner's hostname) as subdomains in DoH queries, which appear as legitimate HTTPS traffic to Harden-Runner's domain-based filtering but are ultimately forwarded to an attacker-controlled domain. This effectively enables data exfiltration without directly connecting to any blocked destination. Exploitation requires the attacker to already have code execution within the GitHub Actions workflow. The issue was fixed in version 2.16.0.

Klassifikation & Betroffenheit:

CWE-693CWE-863 step-security harden-runner < 2.16

Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-1 · Accessing Functionality Not Properly Con… (High) CAPEC-17 · Using Malicious Files (Very High) CAPEC-20 · Encryption Brute Forcing (Low) CAPEC-22 · Exploiting Trust in Client (High) CAPEC-36 · Using Unpublished Interfaces or Function… (High) CAPEC-107 · Cross Site Tracing (Very High) CAPEC-127 · Directory Indexing (Medium) CAPEC-237 · Escaping a Sandbox by Calling Code in An… (Very High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1574.010 · Hijack Execution Flow: ServicesFil… T1574.005 · Hijack Execution Flow: Executable … T1083 · File and Directory Discovery

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-5896 6.1 CVE-2026-33622 6.1 CVE-2025-48554 6.1 CVE-2024-20665 6.1 CVE-2023-22655 6.1

🩹 Patch verfügbar (OSV):

🩹 fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 03/2026

Heute 09.11.

CVSS-Vektor-Analyse: 4.6

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Hoch

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

CNA-Bewertung (GitHub_M): 4.6 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA…

Veröffentlicht:20.03.2026

Aktualisiert:20.03.2026 16:05

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2026-13539

CWE-693 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	785	0,2 %
≥50 %	3.559	0,9 %
≥10 %	13.140	3,2 %
<10 %	396.071	95,8 %

Tier

CVEs

Anteil

≥90 %

785

0,2 %

≥50 %

3.559

0,9 %

≥10 %

13.140

3,2 %

<10 %

396.071

95,8 %

Datenquellen & Methodik: Primärquelle ist die EUVD der ENISA (laufender Datenbank-Sync, alle 15 Minuten), abgeglichen mit dem CISA-KEV-Katalog und der NVD — Detail-Dossiers reichern fehlende Felder live per NVD an — mit Fallback auf CIRCL vulnerability-lookup (EU/Non-Profit, aggregiert CVE-, GitHub- und OSV-Advisories). Der CISA-KEV-Katalog (Known Exploited Vulnerabilities, ~1.700 aktiv ausgenutzte Schwachstellen) wird bei jedem Sync vollständig neu geladen und kreuzreferenziert — filterbar über die KEV-Pille. CVSS 3.1 wird nach Ampel-Logik aus Verteidigersicht dekodiert; EPSS bezeichnet die 30-Tage-Exploit-Wahrscheinlichkeit (FIRST.org).

🇪🇺 ENISA EUVD 🇺🇸 NVD ⚠️ CISA KEV ⚡ EPSS

4.6 MEDIUM

EPSS

0.3%

CVE-2026-32947 🌐 Netzwerk (Remote) 🔐 Admin-Rechte nötig

step-security

CVE-2026-32947 | Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability allows attackers to bypass egress-policy: block network restrictions by tunneling exfiltrated data through permitted HTTPS endpoints like dns.google. The attack works by encoding sensitive data (e.g., the runner's hostname) as subdomains in DoH queries, which appear as legitimate HTTPS traffic to Harden-

CWE-693 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 7 Monaten ↻ vor 7 Monaten

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub