PT-2026-33463 · Unknown · Openharness

Published 2026-04-17 · Updated 2026-04-19 · CVE-2026-40515

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenHarness versions prior to commit bd4df81

Description Incomplete path normalization in the permission checker allows attackers to bypass permissions and read sensitive files. By invoking the built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules, an attacker can disclose sensitive local file content, key material, configuration files, or directory contents.

Recommendations Update to commit bd4df81 or a newer version.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-40515

Affected Products

Openharness

References · 6

• 🔥 https://github.com/HKUDS/OpenHarness/pull/92 · Exploit
• https://github.com/HKUDS/OpenHarness/commit/bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40515 · Security Note
• https://vulncheck.com/advisories/openharness-permission-bypass-via-grep-and-glob-root-argument · Note
• https://twitter.com/CVEnew/status/2045889730751947003 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045234986744221955 · Twitter Post