CVE-2026-32947

CVE-2026-32947 describes a DNS over HTTPS (DoH) vulnerability affecting Harden-Runner versions 2.15.1 and below, a CI/CD security agent for GitHub Actions. This flaw allows an attacker, who already possesses code execution within a workflow, to bypass network egress policies. By encoding sensitive data into DoH queries directed at permitted HTTPS endpoints, they can exfiltrate information to an attacker-controlled domain, appearing as legitimate traffic. Rated Medium severity (CVSS 4.9) with a high confidentiality impact, this vulnerability requires high privileges for exploitation. There is currently no evidence of active exploitation, public exploit code, or significant community discussion.