actions / actions/runner

Ubuntu 24 GitHub Actions Runner Vulnerability Mitigations for CVE-2026-31431 ("Copy Fail")

Open
#4,409 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C#
Stars
6.3k
Forks
1.4k
Avg merge
1d 16h
Merged PRs (30d)
24

Description

We have observed that the GitHub Actions runners are still using Ubuntu 24, which is known to be vulnerable to the recently disclosed CVE-2026-31431 ("Copy Fail") vulnerability.
As we are using the latest version of the runners, we are concerned about the potential security risks associated with this issue. Could you please clarify:

  1. Are there any mitigations already in place for this vulnerability on the current runner images?

  2. If not, what steps are being taken to address this vulnerability, and is there an expected timeline for a patched version of the runner images?

  3. Are there any steps we can take to mitigate the risk partially or fully ourselves?

Thank you in advance for your time.

Runner Version and Platform

ARC Version 0.14.1
ARC Scaleset version 0.14.1
actions runner image version 2.334.0

OS of the machine running the runner? OSX/Windows/Linux/...
Ubuntu 24

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No repository file or test is identified; start by reviewing the Ubuntu 24 runner image and the reported ARC 0.14.1, ARC Scaleset 0.14.1, and runner 2.334.0 versions against the CVE-2026-31431 report. Done means documenting whether mitigations exist, what users can do, and any remediation or patched-image timeline.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, ubuntu
Domain
ci-cd, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.