The flaw in Harden-Runner allows outbound traffic created with sendto, sendmsg, and sendmmsg socket calls to bypass the audit logging configured with egress-policy: audit. This is a CWE‑778 vulnerability that undermines the integrity of audit records by permitting connections to go unseen. Based on the description, it is inferred that an attacker who can trigger code execution on the runner could establish network connections that remain invisible to monitoring, potentially enabling data exfiltration or covert command‑and‑control sessions.

Affected are versions of step-security Harden‑Runner prior to v2.14.2, specifically the Community Tier. The issue applies to any runner instance with egress-policy set to audit. The product is identified as step-security Harden‑Runner community edition.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to control the runner environment or inject malicious workflow code to leverage the bypass. Given the moderate scoring and low exploitation likelihood, the overall risk is considered moderate but should not be ignored.