PT-2026-30930 · Unknown · Openharness

Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-22682

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenHarness versions prior to commit 166fcfe

Description OpenHarness contains an improper access control issue in its built-in file tools. This is due to inconsistent handling of parameters when enforcing permissions. Attackers who can influence agent tool execution may be able to read arbitrary local files outside the intended repository scope. The read file, write file, edit file, and notebook edit tools do not pass the path parameter to the PermissionChecker, bypassing deny rules. This allows access to sensitive files like configuration files, credentials, and SSH material, or the creation and overwriting of files in restricted host paths when in full auto mode.

Recommendations Update OpenHarness to commit 166fcfe or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-22682

Affected Products

Openharness

References · 5

• https://github.com/HKUDS/OpenHarness/commit/166fcfefb7614dbac51bd061f56542725b0298e9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22682 · Security Note
• https://github.com/HKUDS/OpenHarness/pull/32 · Note
• https://twitter.com/CVEnew/status/2041569958694694999 · Twitter Post
• https://vulncheck.com/advisories/openharness-improper-access-control-via-file-tools · Note