CVE-2026-22682
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enforcement. This allows attackers who can influence agent tool execution to read arbitrary local files outside the intended repository scope.
Risk Assessment
Attackers can bypass deny rules and access sensitive files such as configuration files, credentials, and SSH material, or create and overwrite files in restricted host paths in full_auto mode, leading to data leakage and potential system compromise.
Recommendation
Immediately update OpenHarness to a version containing commit 166fcfe or later to ensure the path parameter is properly passed to the PermissionChecker in all file tools.
Other vulnerabilities in OpenHarness
See all- CVE-2026-56696Medium
The /issue and /pr_comments slash commands in OpenHarness lack remote_invocable=False protection, allowing remote senders to inject attacker-controlled Markdown into project context files.
- CVE-2026-40516High
OpenHarness before commit bd4df81 contains a server-side request forgery (SSRF) vulnerability in the web_fetch and web_search tools. Attackers can manipulate tool parameters to access private HTTP services, including localhost, RFC1918, and link-local addresses, without proper validation of target addresses.
- CVE-2026-40515High
A permission bypass vulnerability in OpenHarness before commit bd4df81 allows attackers to read sensitive files by exploiting incomplete path normalization. Attackers can use built-in grep and glob tools with sensitive root directories not properly evaluated against configured path rules, leading to disclosure of local file content, key material, configuration files, or directory contents.
- CVE-2026-40503Medium
A path traversal vulnerability in OpenHarness prior to commit dd1d235 allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. Attackers can bypass the project memory directory validation and access sensitive files accessible to the OpenHarness process.
- CVE-2026-40502High
OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.
Original NVD description (English source)
OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enforcement, allowing attackers who can influence agent tool execution to read arbitrary local files outside the intended repository scope. Attackers can exploit the path parameter not being passed to the PermissionChecker in read_file, write_file, edit_file, and notebook_edit tools to bypass deny rules and access sensitive files such as configuration files, credentials, and SSH material, or create and overwrite files in restricted host paths in full_auto mode.