CVE-2026-40515

Katalog CVE

CVSS 5.5 · Medium EPSS 0,36%

Kerentanan Incorrect Authorization pada hkuds openharness. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules, allowing disclosure of sensitive local file content, key material, configuration files, or directory contents despite configured path restrictions.

Rincian

Terbit di NVD

17 April 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/HKUDS/OpenHarness/commit/bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae patch
• https://www.vulncheck.com/advisories/openharness-permission-bypass-via-grep-and-glob-root-argument advisory pihak ketiga
• https://github.com/HKUDS/OpenHarness/pull/92 exploit · issue tracking