CVE-2026-92750: Harness through 3.3.0 Missing Access Control via infraproviders endpoint
Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Harnessto a version that resolves this vulnerability.Fixed in 3.3.0 - Compensating control
Mitigate by restricting access to the Harness infrastructure provider read endpoint (GET /api/v1/infraproviders) so authenticated users cannot retrieve provider configurations from spaces they do not belong to.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Harness user with permission to make requests to the infrastructure provider API may be able to exploit it. The attacker does not need to belong to the targeted space.
What information could be exposed?
The affected endpoint can disclose infrastructure provider configuration metadata from other spaces, including Docker endpoints, TLS certificate paths, and cloud project identifiers.
What does an attacker need to do?
The attacker can send a GET request to /api/v1/infraproviders using arbitrary space identifiers. Exploitation requires authentication but no user interaction.
How can I determine whether my deployment is affected?
Harness versions through 3.3.0 are identified as affected. You can test with an authenticated non-member account by requesting infrastructure provider data for a space to which that account does not belong.