CVE-2026-22682

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-22682

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22682.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-22682

Published

2026-04-07T17:09:01.033Z

Modified

2026-07-16T03:31:02.042145572Z

Severity

8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenHarness Improper Access Control via File Tools

Details

OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enforcement, allowing attackers who can influence agent tool execution to read arbitrary local files outside the intended repository scope. Attackers can exploit the path parameter not being passed to the PermissionChecker in readfile, writefile, editfile, and notebookedit tools to bypass deny rules and access sensitive files such as configuration files, credentials, and SSH material, or create and overwrite files in restricted host paths in full_auto mode.

Database specific

{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22682.json",
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "166fcfefb7614dbac51bd061f56542725b0298e9"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/hkuds/openharness

Affected ranges

Type

GIT

Repo

https://github.com/hkuds/openharness

Events

Introduced

Fixed

166fcfefb7614dbac51bd061f56542725b0298e9

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22682.json"