> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Runners (RN)

- URL: /taxonomies/software-factory/runners/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T13:04:07.141Z
- Description: Runners (RN): 13 threats in the software factory threat taxonomy. Hosted and self-hosted build agents, caches, artifacts passed between jobs, isolation.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Runners

**Station 04 of 17 · Line 1, Source to Artifact · 13 threats · prefix RN**

The runner is where untrusted code and the factory's secrets share a machine. These cards cover CI controllers, hosted and self-hosted build agents, caches, artifacts passed between jobs, and the isolation between them.

**Scope:** Hosted and self-hosted build agents, caches, artifacts passed between jobs, isolation.

![Table: Runners (RN), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/107/taxonomy-table-04-RN.png =1400x4198)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="rn-a"></span>**RN·A** Persistent Runner
- <span id="rn-k"></span>**RN·K** CI Controller Compromise
- <span id="rn-q"></span>**RN·Q** Cache Poisoning
- <span id="rn-j"></span>**RN·J** Memory and Process Scraping
- <span id="rn-10"></span>**RN·10** Artifact Poisoning Between Jobs
- <span id="rn-9"></span>**RN·9** Runner Network Reach
- <span id="rn-8"></span>**RN·8** Open Egress
- <span id="rn-7"></span>**RN·7** Rogue Runner Registration
- <span id="rn-6"></span>**RN·6** Container Socket Exposure
- <span id="rn-5"></span>**RN·5** Shared Tenant Runner
- <span id="rn-4"></span>**RN·4** Secrets in Logs and Artifacts
- <span id="rn-3"></span>**RN·3** Runner Image Supply Chain
- <span id="rn-2"></span>**RN·2** Resource Hijacking

## Where this station touches others

- **Pipeline Definition and Runners:** the definition is what the pipeline is told to do; the runner is where it executes and what survives between jobs.

## Seen in the wild

- **RN·A Persistent Runner:** PyTorch runners (Stawinski and Khan, 2024).
- **RN·K CI Controller Compromise:** TeamCity CVE-2024-27198 (2024); Jenkins CVE-2024-23897 (2024).
- **RN·Q Cache Poisoning:** Ultralytics cache poisoning (2024).
- **RN·J Memory and Process Scraping:** tj-actions (2025); Trivy (2026).
- **RN·10 Artifact Poisoning Between Jobs:** Artifact poisoning (Legit Security, 2022).
- **RN·8 Open Egress:** Trivy (2026).
- **RN·4 Secrets in Logs and Artifacts:** ArtiPACKED (Unit 42, 2024); tj-actions log leak (2025).

Sources for each case are listed on the [overview page](/taxonomies/software-factory/).

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits all 13 cleanly. CAPEC 3.9 has a pattern that describes 1 of them directly, only a generic parent pattern for 10, and nothing for 2. CWE 4.20 names the weakness directly for 8, has only a broader weakness for 4, and nothing for 1. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Runners (RN), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/107/software-factory-mapping-table-04-RN.png =1400x2373)

---

← [Pipeline Definition (PD)](/taxonomies/software-factory/pipeline-definition/) · [Software factory overview](/taxonomies/software-factory/) · [Pipeline Identity and Secrets (ID)](/taxonomies/software-factory/pipeline-identity-and-secrets/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*