Openharness CVE-2026-40515

No special conditions - remote unauthenticated exploitation against default configurations of OpenHarness deployments. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network-accessible attack requiring no authentication, low complexity, and no user interaction. Exploitation requires only that the OpenHarness instance is network-reachable and that the grep and glob built-in tools are enabled (default behavior). The vulnerability exists in the core permission checking logic rather than optional features. Success depends on the attacker identifying valid sensitive file paths on the target system, which varies by deployment but includes common Unix/Linux paths like /etc, /root, and application-specific configuration directories. No specific platform version, non-default configuration, or elevated privileges required. The primary limiting factor is network accessibility - internally firewalled instances face reduced risk from external attackers but remain vulnerable to authenticated network users or insider threats.

Real-world risk is substantial for internet-exposed OpenHarness instances. CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N indicates network-accessible exploitation with low complexity requiring no authentication or user interaction, making this highly automatable. The confidentiality impact is High (C:H) while integrity and availability remain unaffected, consistent with a read-only information disclosure vulnerability. No CISA KEV listing suggests this is not yet widely exploited in the wild, though the availability of a public GitHub patch and VulnCheck advisory increases attacker awareness. EPSS probability data not provided, limiting statistical exploitation likelihood assessment. The SSVC framework would classify this as: exploitation status likely POC-available (vendor fix published), automatable (network vector, no auth), technical impact partial (confidentiality only). Priority depends heavily on deployment exposure - internet-facing instances with sensitive data accessible to OpenHarness process require immediate patching. Internal-only deployments with limited data access face lower immediate risk. The combination of no authentication requirement and network accessibility makes this a high-priority issue for any exposed deployment, despite absence of confirmed active exploitation.

An unauthenticated remote attacker identifies an internet-exposed OpenHarness instance through reconnaissance scanning. The attacker crafts HTTP requests that invoke the built-in grep tool with arguments targeting sensitive root directories like /etc/shadow, /root/.ssh/, or application configuration paths containing database credentials. Because the permission checker performs incomplete path normalization, the crafted glob patterns bypass configured path restrictions. The grep and glob operations execute successfully, returning file contents or directory listings to the attacker. The attacker exfiltrates SSH private keys, API tokens, database passwords, and other credentials for use in subsequent attacks against the infrastructure. No public exploit code reference provided in intelligence data, but the technical mechanism described enables straightforward exploitation.