Harness
Monthly
Authenticated users on Harness deployments through version 3.3.0 can read infrastructure provider configurations from spaces they do not belong to, because the GET /api/v1/infraproviders endpoint fails to validate space-level access control (CWE-862). Exploitation requires only a valid low-privilege account (CVSS v4.0 PR:L, and the independent assessment rates it PR:L as well), so it is realistic mainly on multi-tenant or multi-space instances where the attacker's account lives in a different space than the targeted provider records; a single-tenant instance with no untrusted users has limited exposure. The result is a confidentiality-only impact (VC:H, no integrity or availability effect) exposing sensitive provider metadata such as Docker endpoints, TLS certificate paths, and cloud project identifiers. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Note: the supplied CVSS v4.0 base score of 7.1 and the independent CVSS v3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) agree on the authenticated, network-reachable, read-only nature of the flaw.
Authenticated users on Harness deployments through version 3.3.0 can read infrastructure provider configurations from spaces they do not belong to, because the GET /api/v1/infraproviders endpoint fails to validate space-level access control (CWE-862). Exploitation requires only a valid low-privilege account (CVSS v4.0 PR:L, and the independent assessment rates it PR:L as well), so it is realistic mainly on multi-tenant or multi-space instances where the attacker's account lives in a different space than the targeted provider records; a single-tenant instance with no untrusted users has limited exposure. The result is a confidentiality-only impact (VC:H, no integrity or availability effect) exposing sensitive provider metadata such as Docker endpoints, TLS certificate paths, and cloud project identifiers. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Note: the supplied CVSS v4.0 base score of 7.1 and the independent CVSS v3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) agree on the authenticated, network-reachable, read-only nature of the flaw.