CVE-2025-32955: Sudo Bypass in Harden-Runner

The disable-sudo feature in Harden-Runner is designed to prevent the runner user from executing commands with elevated privileges. However, due to the runner user's membership in the Docker group, an attacker can leverage the Docker daemon to launch privileged containers or directly access the host filesystem. This effectively circumvents the intended security control, granting the attacker root access. Successful exploitation could allow an attacker to steal sensitive credentials, modify build artifacts, or compromise the entire CI/CD pipeline. The impact is particularly severe in environments where the runner executes code from untrusted sources.

1. Reserved2025-04-14
2. Published2025-04-21
3. Modified2025-04-22
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-32955 is to upgrade Harden-Runner to version 2.12.0 or later, which addresses the sudo bypass vulnerability. If an immediate upgrade is not possible, consider restricting the Docker group's permissions to minimize the potential impact. Implement stricter container security policies, such as limiting the capabilities granted to containers and enforcing read-only access to sensitive files. Monitor Docker daemon activity for suspicious behavior. After upgrading, confirm the fix by attempting to execute sudo commands as the runner user and verifying that they are denied.