Openharness EUVD-2026-23143

Requires authenticated access as a gateway user with chat access permissions in OpenHarness - this is the specific role/feature required. Attack is network-based (AV:N) targeting the chat slash command interface, specifically the '/memory show' command handler. Exploitation succeeds against default configurations that lack filesystem containment validation. The limiting factor is the PR:L authentication requirement: attackers must first obtain valid gateway user credentials with chat privileges, significantly reducing the attack surface compared to unauthenticated vulnerabilities. No user interaction required (UI:N) once authenticated. Files accessible are limited to those readable by the OpenHarness process user account - deployments following least-privilege principles with restricted service accounts will limit exposure scope compared to installations running as root or high-privilege users.

CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-exploitable vulnerability with low complexity requiring low-privilege authentication - specifically, gateway users with chat access rights. The VC:H (high confidentiality impact) with VI:N/VA:N (no integrity or availability impact) confirms this is strictly an information disclosure issue. Real-world risk is moderate: attackers need existing authenticated access to the chat interface, limiting the attack surface compared to unauthenticated flaws. However, once inside that perimeter, exploitation is trivial (AC:L) and can expose sensitive configuration files, credentials, API keys, or other secrets accessible to the OpenHarness process user. No EPSS score available to assess likelihood of mass exploitation. Not listed in CISA KEV, suggesting no confirmed widespread exploitation. The requirement for pre-existing chat access credentials substantially reduces risk compared to the CVSS score alone - this is primarily an insider threat or post-initial-compromise vector rather than an internet-wide exposure. Priority depends on OpenHarness deployment context: high-risk if processing sensitive data or running with elevated privileges, lower-risk if properly isolated with least-privilege process accounts.

An authenticated attacker with gateway chat access connects to the OpenHarness interface and issues a crafted slash command: '/memory show ../../../etc/passwd'. The application fails to validate the path parameter, resolves the traversal sequence, and returns the contents of /etc/passwd to the attacker's chat session. The attacker iterates with additional commands targeting known sensitive file locations (/etc/shadow, application config files, SSH keys, cloud credentials in ~/.aws/credentials) to exfiltrate all data readable by the OpenHarness process user. Since CVSS indicates AC:L (low complexity), no special conditions beyond basic chat access are needed.