CVE-2026-40515

HIGH

7.5

Beschreibung

OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules, allowing disclosure of sensitive local file content, key material, configuration files, or directory contents despite configured path restrictions.

CVE Details

CVSS v3.1 Bewertung7.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht4/17/2026

Zuletzt geandert4/17/2026

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-863

Referenzen

https://github.com/HKUDS/OpenHarness/commit/bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae(disclosure@vulncheck.com)

https://github.com/HKUDS/OpenHarness/pull/92(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/openharness-permission-bypass-via-grep-and-glob-root-argument(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.