Is CVE-2026-32946 actively exploited?

No active exploitation of CVE-2026-32946 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32946 be exploited remotely?

Yes. CVE-2026-32946 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32946?

CVE-2026-32946 has a CVSS score of 2.7 (LOW).

HOME VULNERABILITIESCVE-2026-32946

LOW

CVE-2026-32946

CWE-693Published: March 20, 2026· Updated: Mar 24, 2026

2.7

CVSS v3.1

EPSS:0.08%probability of exploitation in 30 daysPercentile:22.7th

Official Description

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, the Harden-Runner that allows bypass of the egress-policy: block network restriction using DNS queries over TCP. Egress policies are enforced on GitHub runners by filtering outbound connections at the network layer. When egress-policy: block is enabled with a restrictive allowed-endpoints list (e.g., only github.com:443), all non-compliant traffic should be denied. However, DNS queries over TCP, commonly used for large responses or fallback from UDP, are not adequately restricted. Tools like dig can explicitly initiate TCP-based DNS queries (+tcp flag) without being blocked. This vulnerability requires the attacker to already have code execution capabilities within the GitHub Actions workflow. The issue has been fixed in version 2.16.0.

NVD Source

Technical Analysis

CVE-2026-32946 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.