CVE-2026-25598

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the Harden-Runner GitHub Action (Community Tier) that allows outbound network connections to evade audit logging. Specifically, outbound traffic using the sendto, sendmsg, and sendmmsg socket system calls can bypass detection and logging when using egress-policy: audit. This vulnerability is fixed in 2.14.2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-778

Affected software

No affected versions have been published.

Timeline

Published
Feb 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-255996.3Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input valCVE-2026-25606.3A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the function run of the file plugins/fileThumb/libCVE-2026-256006.4The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s eCVE-2026-256016.7A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded crypCVE-2026-256022.3Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client tCVE-2026-256036.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that cCVE-2026-256045.4In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instaCVE-2026-256057.1A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file deletion without propCVE-2026-256068.7A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters alCVE-2026-256075.7Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords withCVE-2026-256082.3STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain CVE-2026-256094.3Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.