CVE-2025-32955: Harden-Runner Privilege Escalation via Docker Evasion
Summary
CVE-2025-32955: Harden-Runner allows evasion of 'disable-sudo' policy. Affects step-security/harden-runner versions >= 0.12.0, < 2.12.0. Fixed in 2.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Harden-Runner is a security-focused GitHub Actions runner designed to enhance the security of CI/CD pipelines by enforcing strict policies. One of its key features is the 'disable-sudo' policy, which aims to prevent the runner user from executing commands with elevated privileges. However, this package is vulnerable to a privilege escalation attack due to its reliance on Docker, which can be exploited by users with malicious intent.
Vulnerability Detail
The vulnerability arises from the 'disable-sudo' policy in Harden-Runner, which is intended to restrict the runner user from using sudo by removing them from the sudoers file. However, since the runner user is part of the docker group, they can interact with the Docker daemon to launch privileged containers or access the host filesystem. This allows an attacker, who can execute malicious code on the runner, to regain root access or modify the sudoers file, effectively bypassing the intended security measures. The vulnerability has been identified as having a CVSS score of 6.0, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.12.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can migrate to the 'disable-sudo-and-containers' policy, which not only disables sudo access but also removes access to Docker sockets and uninstalls Docker from the runner. This can be configured in the Harden-Runner settings to prevent any container-based privilege escalation paths.
Conclusion
The Harden-Runner vulnerability CVE-2025-32955 allows for privilege escalation through Docker evasion, impacting users who rely on the 'disable-sudo' policy. It is crucial for users to update to version 2.12.0 or later and consider implementing additional security measures to protect their CI/CD environments.
See every vulnerability recorded for step-security/harden-runner →
FAQ
An attacker can escalate privileges to root on a runner configured with 'disable-sudo: true' by exploiting Docker, thereby bypassing security controls.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider implementing the 'disable-sudo-and-containers' policy as a temporary workaround to mitigate the risk of privilege escalation.
No, this issue specifically affects configurations using 'disable-sudo: true' on GitHub-hosted runners or ephemeral self-hosted VM-based runners, but not Kubernetes-based Actions Runner Controller.
Yes, the 'disable-sudo' option will be deprecated as it does not sufficiently restrict privilege escalation on its own.
References
Related vulnerabilities
Recent vulnerabilities recorded for step-security/harden-runner.
