CVE-2026-40515: OpenHarness Permission Bypass via grep and glob root argument
OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules, allowing disclosure of sensitive local file content, key material, configuration files, or directory contents despite configured path restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenHarnessto a version that resolves this vulnerability.Patch bd4df81
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40515?
CVE-2026-40515 is classified as a high severity vulnerability due to its potential to allow unauthorized access to sensitive files.
How do I fix CVE-2026-40515?
To fix CVE-2026-40515, update OpenHarness to a version later than commit bd4df81 to remove the vulnerability.
What types of attacks can exploit CVE-2026-40515?
CVE-2026-40515 can be exploited by attackers to bypass permissions and access restricted files through crafted grep and glob root arguments.
Which versions of OpenHarness are affected by CVE-2026-40515?
OpenHarness versions up to but not including bd4df81 are affected by CVE-2026-40515.
What should I do if I cannot immediately update OpenHarness for CVE-2026-40515?
If an immediate update is not possible, restrict access to the affected software and monitor for any suspicious activities as a temporary measure.