CVE-2026-40515
Permission Bypass in OpenHarness Allows Sensitive File Disclosure
Publication date: 2026-04-17
Last updated on: 2026-04-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hkuds | openharness | to 2026-04-11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenHarness before commit bd4df81 and is a permission bypass issue. It occurs because the permission checker does not fully normalize file paths, allowing attackers to exploit this incomplete path normalization.
Attackers can use built-in tools like grep and glob to access sensitive root directories that should be restricted by path rules. Due to improper evaluation of these paths, attackers can read sensitive files such as local file content, key material, configuration files, or directory listings despite the intended restrictions.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information. Attackers can read confidential files, including key material and configuration files, which may compromise system security.
Because the vulnerability allows remote attackers to bypass permissions without any privileges or user interaction, it poses a high risk of data exposure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers to bypass permission checks and read sensitive files, including key material and configuration files, despite configured path restrictions.
Such unauthorized disclosure of sensitive local file content could lead to violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls over access to sensitive data.
Therefore, exploitation of this vulnerability may result in non-compliance with these regulations due to unauthorized data exposure.