HKUDS OpenHarness Path Normalization authorization

Summaryinfo

A vulnerability was found in HKUDS OpenHarness. It has been rated as problematic. This affects an unknown part of the component Path Normalization Handler. The manipulation leads to authorization. This vulnerability is referenced as CVE-2026-40515. Remote exploitation of the attack is possible. No exploit is available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in HKUDS OpenHarness (version unknown). This issue affects an unknown function of the component Path Normalization Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is confidentiality. The summary by CVE is:

OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules, allowing disclosure of sensitive local file content, key material, configuration files, or directory contents despite configured path restrictions.

The weakness was published by Chia Min Jun Lennon. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-40515 since 04/13/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Applying the patch bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-23450). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• HKUDS

Name

• OpenHarness

Website

• Product: https://github.com/HKUDS/OpenHarness/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion